by Kastro
Paper/Archive/CVE-2021-23383

CVE-2021-23383

snyk — Prototype Pollution

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.5.915 × 2018.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Affected

ProductAffectedFixed inSource
handlebarsunspecified – < 4.7.74.7.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427refsnyk.io/vuln/SNYK-JS-HANDLEBARS-1279029refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032refsecurity.netapp.com/advisory/ntap-20210618-0007