En bref
- CVE-2015-8857 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant uglifier, uglifyjs (uglifyjs project), uglify-js.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 3.6%, plus élevée que 89.4% des vulnérabilités.
- Correctif : mettre à jour vers 2.7.2, 2.4.24 ou plus récent.
Description
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
NVD description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free