Arbitrary JavaScript Execution in bassmaster

NGHIÊM TRỌNG 10.0CVE-2014-7205 · GHSA-5j3g-jfq3-7jwx · Công bố 08/10/2014 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
bassmaster bassmaster_project	`< 1.5.2`	`1.5.2`
bassmaster npm	`< 1.5.2`	`1.5.2`

Mô tả

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.

Recommendation

Update to bassmaster version 1.5.2 or greater.

Mô tả của NVD

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2014-7205 · ADVISORY
hapijs/bassmaster commit b751602 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96730 · WEB
GitHub Advisory GHSA-5j3g-jfq3-7jwx · ADVISORY
hapijs/bassmaster · PACKAGE
exploit-db.com/exploits/40689 · WEB
npmjs.com/advisories/1 · WEB
openwall.com/lists/oss-security/2014/09/30/10 · WEB
securityfocus.com/bid/70180 · WEB
nodesecurity.io/advisories/bassmaster_js_injection · Third Party Advisory
exploit-db.com/exploits/40689 · Third Party Advisory

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí