CVE-2021-41280

    Dashboard / Vulnerabilities / CVE-2021-41280

    CVE-2021-41280

    Published: 19 Nov 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.

    References: https://github.com/sharetribe/sharetribe/releases/tag/v10.2.1, https://github.com/sharetribe/sharetribe/security/advisories/GHSA-hjjc-p9hr-424c, https://github.com/sharetribe/sharetribe/commit/5b844f8108c5458d89f0d7ba974f42d7917b5f80

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -6271b7a77932ba0e15a0ed6229fbccb01ff3b682

    Affected versions

    v10.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41280 | CVE-DB