« Volver al listado

CVE-2019-10804

Estado: ModificadaCrítica (9.8)—

serial-number versiones hasta 1.3.0, permite una ejecución de comandos arbitraria. El argumento "cmdPrefix" en la función Serial-Number es usado por la función "exec" sin ninguna comprobación.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Serial-number Project — Serial-number

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-10804",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "serial-number",
          "versions": [
            {
              "status": "affected",
              "version": "All versions including 1.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-28T21:15:13.087",
  "references": [
    {
      "url": "https://github.com/es128/serial-number/blob/master/index.js#L106",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://github.com/es128/serial-number/blob/master/index.js#L106",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "serial-number through 1.3.0 allows execution of arbritary commands. The \"cmdPrefix\" argument in serialNumber function is used by the \"exec\" function without any validation."
    },
    {
      "lang": "es",
      "value": "serial-number versiones hasta 1.3.0, permite una ejecución de comandos arbitraria. El argumento \"cmdPrefix\" en la función Serial-Number es usado por la función \"exec\" sin ninguna comprobación."
    }
  ],
  "lastModified": "2026-06-17T02:11:42.343",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:serial-number_project:serial-number:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "663B76F1-E8D6-4D8E-9EB5-4C5FC10F8813",
              "versionEndIncluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "report@snyk.io"
}