« Back to list

CVE-2021-23412

Status: ModifiedCritical (9.8)—

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Gitlogplus Project — Gitlogplus

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-23412",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "report@snyk.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "gitlogplus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-23T16:15:09.923",
  "references": [
    {
      "url": "https://hackerone.com/reports/808942",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://www.npmjs.com/package/gitlogplus",
      "tags": [
        "Product"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://hackerone.com/reports/808942",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.npmjs.com/package/gitlogplus",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization."
    },
    {
      "lang": "es",
      "value": "Todas las versiones del paquete gitlogplus, son vulnerables a la Inyección de Comandos por medio de la funcionalidad main, ya que los atributos de las opciones se anexan al comando para ser ejecutado sin saneamiento"
    }
  ],
  "lastModified": "2026-06-17T03:38:42.957",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlogplus_project:gitlogplus:3.1.3:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD575D9A-6E3A-4FB3-9855-01AABD4F5C2F"
            },
            {
              "criteria": "cpe:2.3:a:gitlogplus_project:gitlogplus:3.1.4:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3700C9B5-D4D6-4F71-A1EA-9F119E04BDEA"
            },
            {
              "criteria": "cpe:2.3:a:gitlogplus_project:gitlogplus:3.1.5:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B875C8BC-BAA7-4A36-AAFB-2F81652FC2DF"
            },
            {
              "criteria": "cpe:2.3:a:gitlogplus_project:gitlogplus:3.1.6:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C276619C-B049-46B8-B06F-C158CE090504"
            },
            {
              "criteria": "cpe:2.3:a:gitlogplus_project:gitlogplus:3.1.7:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B904705-7B79-4921-8569-B6360AD406A7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "report@snyk.io"
}