CVE-2022-21810 — HIGH (7.4)

Vulnerability Description

All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Smartctl Project	Smartctl	All versions

Related Weaknesses (CWE)

CWE-78 CWE-77

References

https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a71Broken Link
https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613ExploitThird Party Advisory
https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a71Broken Link
https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613ExploitThird Party Advisory

FAQ

What is CVE-2022-21810?

CVE-2022-21810 is a vulnerability with a CVSS score of 7.4 (HIGH). All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.

How severe is CVE-2022-21810?

CVE-2022-21810 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-21810?

Check the references section above for vendor advisories and patch information. Affected products include: Smartctl Project Smartctl.