Vulnerability Description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Systeminformation | Systeminformation | < 5.3.1 |
| Apache | Cordova | 10.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297aPatch
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8Third Party Advisory
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddIssue TrackingMailing List
- https://security.netapp.com/advisory/ntap-20210312-0007/Third Party Advisory
- https://www.npmjs.com/package/systeminformationProduct
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297aPatch
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8Third Party Advisory
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddIssue TrackingMailing List
- https://security.netapp.com/advisory/ntap-20210312-0007/Third Party Advisory
- https://www.npmjs.com/package/systeminformationProduct
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-US Government Resource
FAQ
What is CVE-2021-21315?
CVE-2021-21315 is a vulnerability with a CVSS score of 7.1 (HIGH). The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation be...
How severe is CVE-2021-21315?
CVE-2021-21315 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21315?
Check the references section above for vendor advisories and patch information. Affected products include: Systeminformation Systeminformation, Apache Cordova.