CVE-2021-23369

Опубликовано: 12 апр. 2021

Источник: nvd

CVSS3: 5.6

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Ссылки

https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
Patch
Third Party Advisory
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0008/
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
Exploit
Third Party Advisory
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
Patch
Third Party Advisory
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0008/
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*

Версия до 4.7.7 (исключая)

EPSS

Процентиль: 94%

0.07028

Низкий

5.6 Medium

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2021-23369

CVSS3: 5.6

ubuntu

больше 5 лет назад

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2021-23369

CVSS3: 9.8

redhat

больше 5 лет назад

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2021-23369

CVSS3: 5.6

debian

больше 5 лет назад

The package handlebars before 4.7.7 are vulnerable to Remote Code Exec ...

GHSA-f2jv-r9rf-7988

CVSS3: 9.8

github

больше 5 лет назад

Remote code execution in handlebars when compiling templates

EPSS

Процентиль: 94%

0.07028

Низкий

5.6 Medium

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

NVD-CWE-noinfo