CVE-2021-23383

Katalog CVE

CVSS 9.8 · Critical EPSS 4,5%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada handlebarsjs handlebars, netapp e-series performance analyzer. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Rincian

Terbit di NVD

4 Mei 2021

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

4,5% peluang dieksploitasi; lebih tinggi dari 91,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 exploit · patch · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210618-0007/ advisory pihak ketiga