Critical severity · published May 4, 2021
CVE-2021-23383
Prototype Pollution
9.8
CVSS
4.5%
EPSS
No
On KEV
Description
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
handlebars ·
before 4.7.7 · source: vendor, NVD
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23383
Patch
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210618-0007/
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
Exploit
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
More from handlebars
9.8
CVE-2021-23369
Remote Code Execution (RCE)