En resumen
- CVE-2015-8857 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a uglifier, uglifyjs (uglifyjs project), uglify-js.
- Probabilidad de explotación en los próximos 30 días (EPSS): 3.6%, mayor que el 89.4% de las vulnerabilidades.
- Solución: actualizar a 2.7.2, 2.4.24 o posterior.
Description
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
NVD description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free