Command Injection Vulnerability in morgan Package by Node.js Vendor
CVE-2019-5413
9.8CRITICAL
Key Information:
- Vendor
Morgan Project
- Status
- Vendor
- CVE Published:
- 21 March 2019
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2019-5413?
The morgan package for Node.js is susceptible to command injection due to improper handling of the format parameter. An attacker can exploit this vulnerability by sending crafted input, potentially allowing the execution of arbitrary commands on the server. Developers using affected versions prior to 1.9.1 are urged to update to ensure their applications remain secure from potential exploits.
Affected Version(s)
morgan < 1.9.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.