Em resumo
- CVE-2015-8857 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta uglifier, uglifyjs (uglifyjs project), uglify-js.
- Chance de exploração nos próximos 30 dias (EPSS): 3.6%, maior que 89.4% das vulnerabilidades.
- Correção: atualize para 2.7.2, 2.4.24 ou posterior.
Description
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
NVD description
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free