Arbitrary JavaScript Execution in bassmaster

緊急 10.0CVE-2014-7205 · GHSA-5j3g-jfq3-7jwx · 08/10/2014 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
bassmaster bassmaster_project	`< 1.5.2`	`1.5.2`
bassmaster npm	`< 1.5.2`	`1.5.2`

概要

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.

Recommendation

Update to bassmaster version 1.5.2 or greater.

NVD の説明

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

参考情報

nvd.nist.gov/vuln/detail/CVE-2014-7205 · ADVISORY
hapijs/bassmaster commit b751602 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96730 · WEB
GitHub Advisory GHSA-5j3g-jfq3-7jwx · ADVISORY
hapijs/bassmaster · PACKAGE
exploit-db.com/exploits/40689 · WEB
npmjs.com/advisories/1 · WEB
openwall.com/lists/oss-security/2014/09/30/10 · WEB
securityfocus.com/bid/70180 · WEB
nodesecurity.io/advisories/bassmaster_js_injection · Third Party Advisory
exploit-db.com/exploits/40689 · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン