CVE:CVE-2019-10746
CNNVD:CNNVD-201908-1907
mixin-deep是一款能够将对象属性混合到第一个对象中的模块。
mixin-deep 1.3.2之前版本和2.0.0版本中存在参数注入漏洞。该漏洞源于外部输入数据构造命令参数的过程中，网络系统或产品未正确过滤参数中的特殊字符。攻击者可利用该漏洞执行非法命令。
solution:Upgrade mixin-deep_project mixin-deep to a higher version than 1.3.2,2.0.0,and avoid the version (,1.3.2),2.0.0; Upgrade fedoraproject fedora to a higher version than 30,31,and avoid the version 30,31; Upgrade oracle communications_cloud_native_core_network_function_cloud_native_environment to a higher version than 1.4.0,and avoid the version 1.4.0