CVE-2021-23337

lodash, oracle banking corporate lending process management, oracle banking credit facilities process management +20 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-23337

Katalog CVE

CVSS 7.2 · High EPSS 21,3%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada lodash, oracle banking corporate lending process management +21 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Rincian

Terbit di NVD
15 Februari 2021
Terakhir diubah
8 Oktober 2026
Status NVD
Modified
CVSS 3.1
7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari)
21,3% peluang dieksploitasi; lebih tinggi dari 97,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
lodash lodash Semua versi sebelum 4.17.21
oracle banking corporate lending process management Versi 14.2.0
oracle banking corporate lending process management Versi 14.3.0
oracle banking corporate lending process management Versi 14.5.0
oracle banking credit facilities process management Versi 14.2.0
oracle banking credit facilities process management Versi 14.3.0
oracle banking credit facilities process management Versi 14.5.0
oracle banking extensibility workbench Versi 14.2.0
oracle banking extensibility workbench Versi 14.3.0
oracle banking extensibility workbench Versi 14.5.0
oracle banking supply chain finance Versi 14.2.0
oracle banking supply chain finance Versi 14.3.0
oracle banking supply chain finance Versi 14.5.0
oracle banking trade finance process management Versi 14.2.0
oracle banking trade finance process management Versi 14.3.0
oracle banking trade finance process management Versi 14.5.0
oracle communications cloud native core binding support function Versi 1.9.0
oracle communications cloud native core policy Versi 1.11.0
oracle communications design studio Versi 7.4.2.0.0
oracle communications services gatekeeper Versi 7.0
oracle communications session border controller Versi 8.4
oracle communications session border controller Versi 9.0
oracle enterprise communications broker Versi 3.2.0
oracle enterprise communications broker Versi 3.3.0
oracle financial services crime and compliance management studio Versi 8.0.8.2.0
oracle financial services crime and compliance management studio Versi 8.0.8.3.0
oracle health sciences data management workbench Versi 2.5.2.1
oracle health sciences data management workbench Versi 3.0.0.0
oracle jd edwards enterpriseone tools Semua versi sebelum 9.2.6.1
oracle peoplesoft enterprise peopletools Versi 8.58
oracle peoplesoft enterprise peopletools Versi 8.59
oracle primavera gateway Versi 17.12.0 hingga 17.12.11
oracle primavera gateway Versi 18.8.0 hingga 18.8.12
oracle primavera gateway Versi 19.12.0 hingga 19.12.11
oracle primavera gateway Versi 20.12.0 hingga 20.12.7
oracle primavera unifier Versi 17.7 hingga 17.12
oracle primavera unifier Versi 18.8
oracle primavera unifier Versi 19.12
oracle primavera unifier Versi 20.12
oracle retail customer management and segmentation foundation Versi 19.0
netapp active iq unified manager Semua versi
netapp cloud manager Semua versi
netapp system manager Versi 9.0
siemens sinec ins Semua versi sebelum 1.0
siemens sinec ins Versi 1.0
siemens sinec ins Versi 1.0 sp1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 12:28 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.