CVE-2021-23383
Prototype Pollution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
El package handlebars versiones anteriores a 4.7.7, son vulnerables a una ContaminaciĆ³n de Prototipos al seleccionar determinadas opciones de compilaciĆ³n para agrupar plantillas que provienen de una fuente no confiable
A flaw was found in nodejs-handlebars. A unescaped value in the JavaScriptCompiler.prototype.depthedLookup function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system (e.g. browser or server) when the template is compiled with the compat:true option. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-08 CVE Reserved
- 2021-05-04 CVE Published
- 2021-06-28 First Exploit
- 2024-01-18 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
https://security.netapp.com/advisory/ntap-20210618-0007 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/dn9uy3n/Check-CVE-2021-23383 | 2021-06-28 | |
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 | 2024-09-16 | |
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 | 2024-09-16 | |
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 | 2024-09-16 | |
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 | 2024-09-16 |
URL | Date | SRC |
---|---|---|
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 | 2021-12-03 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2021-23383 | 2023-03-20 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1956688 | 2023-03-20 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Handlebarsjs Search vendor "Handlebarsjs" | Handlebars Search vendor "Handlebarsjs" for product "Handlebars" | < 4.7.7 Search vendor "Handlebarsjs" for product "Handlebars" and version " < 4.7.7" | node.js |
Affected
| ||||||
Netapp Search vendor "Netapp" | E-series Performance Analyzer Search vendor "Netapp" for product "E-series Performance Analyzer" | - | - |
Affected
|