How severe is CVE-2021-24033?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.6 out of 10.

What type of vulnerability is CVE-2021-24033?

This is classified as CWE-78, which is a common weakness in software security.

CVE-2021-24033 - MEDIUM Severity | CVSS 5.6

Vulnerability Description

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.

Related Vulnerabilities

CVE-2020-7789

MEDIUM

CVSS:5.6(Medium)

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

CWE-782020

CVE-2016-6459

MEDIUM

CVSS:5.5(Medium)

Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated, local attacker to execute a local shell command injection. More Information: CS...

CWE-782016

CVE-2016-7844

MEDIUM

CVSS:5.5(Medium)

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template.

CWE-782016

CVE-2019-14337

MEDIUM

CVSS:5.5(Medium)

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the `/bin...

CWE-782019

CVE-2019-1725

MEDIUM

CVSS:5.5(Medium)

A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local attacker to overwrite an arbitrary file on ...

CWE-782019

CVE-2022-34769

MEDIUM

CVSS:5.5(Medium)

Michlol - rashim web interface Insecure direct object references (IDOR). First of all, the attacker needs to login. After he performs log into the system there are some functionalities that the specif...

CWE-782022