Environment Variable Hijacking Vulnerability in ffmpeg Module by NPM
CVE-2017-16068

7.5HIGH

Key Information:

Vendor

Hackerone

Status
Ffmepg Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2017-16068?

The ffmpeg module was identified as having a serious vulnerability that allowed for the hijacking of environment variables. This malicious module was subsequently unpublished from the NPM registry to mitigate potential risks it posed to developers and applications relying on it.

Affected Version(s)

ffmepg node module All versions

References

https://nodesecurity.io/advisories/507
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.