What is GHSA-g389-rf5p-fg56?

GHSA-g389-rf5p-fg56 is a security advisory published by GitHub Security Advisories with Critical severity. Badaso vulnerable to Remote Code Execution (RCE)

Which CVE IDs does GHSA-g389-rf5p-fg56 cover?

GHSA-g389-rf5p-fg56 covers the following CVE IDs: CVE-2022-41705. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g389-rf5p-fg56?

GHSA-g389-rf5p-fg56 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-g389-rf5p-fg56?

GHSA-g389-rf5p-fg56 affects 1 product, including: composer/badaso/core:\u003c 2.7.0.

GHSA-g389-rf5p-fg56CriticalCVSS 9.8

Badaso vulnerable to Remote Code Execution (RCE)

Vendor

GitHub Security Advisories

Published

November 25, 2022

Last Modified

April 29, 2025

🔗 CVE IDs covered (1)

CVE-2022-41705 →

📋 Description

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

🎯 Affected products1

composer/badaso/core:< 2.7.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-41705
https://github.com/uasoft-indonesia/badaso/issues/818
https://fluidattacks.com/advisories/headhunterz
https://github.com/uasoft-indonesia/badaso
https://github.com/advisories/GHSA-g389-rf5p-fg56