CVE-2021-23383CWE-1321

CVE-2021-23383

Medium · published May 4, 2021

CVSS v3.1
5.6
EPSS
5%
Percentile
91.5
In the wild
Unconfirmed
What it is

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.04506 · 91.5th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2021-05-04T13:15Z
Affected products (2)
ProductVersionsFixed in
handlebarsjs/handlebars< 4.7.74.7.7
netapp/e-series_performance_analyzerall versions—
References (12)
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 · [email protected]https://security.netapp.com/advisory/ntap-20210618-0007/ · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 · [email protected]https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 · [email protected]https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210618-0007/ · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 MAY 08:35Z
    Prototype Pollution
    cvelistv5