Detections
Analytics

CVE-2021-23337

high

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

References

https://www.oracle.com/security-alerts/cpuoct2021.html

https://www.oracle.com/security-alerts/cpujul2022.html

https://www.oracle.com/security-alerts/cpujan2022.html

https://www.oracle.com//security-alerts/cpujul2021.html

https://snyk.io/vuln/SNYK-JS-LODASH-1040724

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930

https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932

https://security.netapp.com/advisory/ntap-20210312-0006/

https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Details

Source: Mitre, NVD

Published: 2021-02-15

Updated: 2022-09-13

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High