CVE-2021-23277CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code

High · published April 13, 2021

CVSS v3.1
8.3
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00962 · 61.3th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2021-04-13T18:04Z
EPSS history
Timeline
  • 13 APR 18:04Z
    Improper Neutralization of Directives in Dynamically Evaluated Code
    cvelistv5