CVE-2018-16460

moderate-risk
Published 2018-09-07

A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.

Do I need to act?

~
3.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 93ec05b2e61d87985e0b829ea241372add45d5f3
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Ps

Affected Vendors

Umbraengineering

References (2)

Third Party Advisory https://hackerone.com/reports/390848
Third Party Advisory https://hackerone.com/reports/390848
44
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 7/34 · Low
Exposure 5/34 · Minimal