title: Command Injection
description: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
problem types: Command Injection
affected:
{
product: systeminformation
vendor: n/a
versions:
lessThan: 4.27.11, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P
version: 3.1
]