CVE-2022-4643 — Vulnerability in code.sajari.com/docconv — CVE Details

CRITICAL

docconv OS Command Injection vulnerability

Published December 22, 2022Updated May 20, 2024Source: osv

Summary

A vulnerability was found in docconv prior to version 1.2.1. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 can address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability.

Advisory Timeline

First published December 22, 2022 (1390 days ago).
Last revised May 20, 2024 — 516 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update code.sajari.com/docconv to 1.3.5 or later

go get code.sajari.com/docconv@v1.3.5

Update github.com/sajari/docconv to 1.2.1 or later

go get github.com/sajari/docconv@v1.2.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (2).

Package	Ecosystem	Affected	Fixed In
code.sajari.com/docconv	go	All versions	1.3.5
github.com/sajari/docconv	go	All versions	1.2.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-78
OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-4643?: docconv OS Command Injection vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-4643?: CVE-2022-4643 affects code.sajari.com/docconv and github.com/sajari/docconv. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-4643 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-6m4h-hfpp-x8cx

GO-2022-1184

Related CVEs

CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies