CVE-2023-25805CWE-77

versionn Command Injection Vulnerability

Critical · published February 20, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

🚨 A command injection vulnerability in versionn could allow attackers to run arbitrary commands on your system, and it's a doozy — all versions before 1.1.0 are affected! 🔥 Think of it like giving someone access to the control panel of a theme park without verifying their identity — they can push all the buttons and make rides go haywire! If exploited, an attacker could execute any command they want, leading to devastating consequences like data leakage, system corruption, or even complete takeover of your environment. The stakes are incredibly high!

Put simply

Think of it like giving someone access to the control panel of a theme park without verifying their identity — they can push all the buttons and make rides go haywire! This vulnerability arises from insufficient validation in the way versionn handles user input, allowing an attacker to inject harmful commands that the system executes without proper checks.

What to do

If exploited, an attacker could execute any command they want, leading to devastating consequences like data leakage, system corruption, or even complete takeover of your environment. The stakes are incredibly high! To secure your systems, upgrade to version 1.1.0 immediately! Additionally, review any configurations that might expose your system to untrusted inputs and implement strict validation measures. You've got this! With the right steps, you'll have your systems protected in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01584 · 75.4th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2023-02-20T15:45Z
EPSS history
Timeline
  • 20 FEB 15:45Z
    versionn Command Injection Vulnerability
    cvelistv5