CVE-2021-23383
⚪ Do wiadomości
Zanieczyszczenie prototypu w Handlebars umożliwia atakującym manipulację obiektami.
CVSS
5.6
EPSS
4.5%
Exploit
poc
Vendor
handlebarsjs
Opis źródłowy (NVD)
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.6 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 4.5% |
| Opublikowano (NVD) | 2021-05-04 09:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:17:07 UTC |
Referencje
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 ([email protected]) [Patch, Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20210618-0007/ ([email protected]) [Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 ([email protected]) [Exploit, Patch, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 ([email protected]) [Exploit, Patch, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 ([email protected]) [Exploit, Patch, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 ([email protected]) [Exploit, Patch, Third Party Advisory]