{"id":"CVE-2013-3364","aliases":["GHSA-28gr-86hg-r48w"],"status":"published","title":"Unauthenticated Remote Command Injection in ep_imageconvert","description":"ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert \u003c= 0.0.2 is vulnerable to remote command injection.\n\nAuthentication is not required for remote exploitation.\n\n\n## Recommendation\n\nUpdate to version 0.0.3 or greater.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2020-08-31T22:43:31Z","modified":"2023-11-08T03:57:19Z","fixes":[{"ecosystem":"npm","package":"ep_imageconvert","fixed_in":["0.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ep_imageconvert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.2"},{"fixed":"0.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"ep_imageconvert","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.3"}]}]}],"references":[{"url":"https://github.com/redhog/ep_imageconvert/pull/5","tags":["web"]},{"url":"https://www.npmjs.com/advisories/7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3364","tags":["advisory"]},{"url":"https://snyk.io/vuln/npm:ep_imageconvert:20130506","tags":["web"]},{"url":"https://github.com/advisories/GHSA-28gr-86hg-r48w"},{"url":"https://github.com/redhog/ep_imageconvert","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-28gr-86hg-r48w","title":"Unauthenticated Remote Command Injection in ep_imageconvert","description":"ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert \u003c= 0.0.2 is vulnerable to remote command injection.\n\nAuthentication is not required for remote exploitation.\n\n\n## Recommendation\n\nUpdate to version 0.0.3 or greater.","status":"published","published":"2020-08-31T22:43:31Z","modified":"2023-01-09T05:03:48Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:06.317379Z"}],"osv":[{"id":"GHSA-28gr-86hg-r48w","title":"Unauthenticated Remote Command Injection in ep_imageconvert","description":"ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert \u003c= 0.0.2 is vulnerable to remote command injection.\n\nAuthentication is not required for remote exploitation.\n\n\n## Recommendation\n\nUpdate to version 0.0.3 or greater.","status":"published","published":"2020-08-31T22:43:31Z","modified":"2023-11-08T03:57:19.572545Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}