Kurz gesagt
- CVE-2015-8857 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in uglifier, uglifyjs (uglifyjs project), uglify-js.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.6%, höher als bei 89.4% aller Schwachstellen.
- Abhilfe: auf 2.7.2, 2.4.24 oder neuer aktualisieren.
Description
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
NVD description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free