by Kastro
Paper/Archive/CVE-2021-23390

CVE-2021-23390

snyk — Arbitrary Code Execution

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.3.873 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

Affected

ProductAffectedFixed inSource
total4unspecified – < 0.0.430.0.43CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

References

refsnyk.io/vuln/SNYK-JS-TOTAL4-1130527refgithub.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455refgithub.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821