CVE-2019-10788

Name of the Vulnerable Software and Affected Versions im-metadata versions 3.0.1 and earlier

Description The issue allows remote attackers to execute arbitrary commands via the exec argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the exec function.

Recommendations For im-metadata versions 3.0.1 and earlier, consider disabling the exec function until a patch is available to prevent arbitrary command execution. Restrict access to metadata options to minimize the risk of exploitation.