CVE-2021-23358GHSA-CF4H-3JHX-XVHQ
Arbitrary Code Injection
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.13.0-2, 1.12.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- n/a underscore
From 1.13.0-0; fixed in 1.13.0-2; From 1.3.2; fixed in 1.12.1
- underscorenpm
From 1.3.2 · fixed in 1.12.1
References 17
snyk.io
GitHub · jashkenas/underscore
lists.debian.org
debian.org
lists.apache.org
- thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf@<issues.cordova.apache.org>
- thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1@<issues.cordova.apache.org>
- thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba@<issues.cordova.apache.org>
- thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039@<issues.cordova.apache.org>
- thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306@<issues.cordova.apache.org>