CVE-2013-3364: 
JavaScript vulnerability analysis and mitigation

ep_imageconvert, a plugin for Etherpad Lite, versions 0.0.2 and earlier were found to contain a remote command injection vulnerability (CVE-2013-3364). The vulnerability was discovered in 2013 and allows remote attackers to execute arbitrary commands without requiring authentication (GitHub Advisory).

The vulnerability exists due to the insecure use of child_process.exec instead of child_process.execFile in the application. This implementation flaw allows for command injection attacks. The vulnerability has a CVSS v3.1 base score of 8.2 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. The vulnerability is classified as CWE-77 (Command Injection) (GitHub Advisory).

The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the affected system, potentially leading to high confidentiality impact and low integrity impact. The attack vector is network-accessible and requires no special privileges or user interaction (GitHub Advisory).

The vulnerability is highly exploitable as it requires no authentication, has low attack complexity, and can be executed remotely without user interaction. The attack vector is network-accessible, making it particularly dangerous for exposed systems (GitHub Advisory).

Users should update to version 0.0.3 or later, which resolves the security issue by replacing child_process.exec with child_process.execFile. The fix was implemented through a pull request that addressed the command injection vulnerability (GitHub PR).