CVE-2023-42810

systeminformation SSID Command Injection Vulnerability

Summary

Original description

The description as published by the source.

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only).

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-42810 node-systeminformation

References

advisory github.com
advisory github.com
advisory nvd.nist.gov
patch github.com
web systeminformation.io

Metadata

CVE: CVE-2023-42810
GHSA: GHSA-gx6r-qc2v-3p3v
Published: 2023-09-21
First seen on SecPulse: 3 years ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-77

Detection sources

OSV.dev (Open Source Vulnerabilities) 2 months ago