Arbitrary JavaScript Execution in bassmaster

严重 10.0CVE-2014-7205 · GHSA-5j3g-jfq3-7jwx · Published 08/10/2014 · updated 17/06/2026

要点

CVE-2014-7205 是影响 bassmaster (bassmaster project), bassmaster 的严重 (CVSS 10.0)漏洞。
未来 30 天内被利用的概率（EPSS）：78.6%，高于 99.6% 的漏洞。
修复：升级到 1.5.2 或更高版本。

Package	Affected versions	Patched versions
bassmaster bassmaster_project	`< 1.5.2`	`1.5.2`
bassmaster npm	`< 1.5.2`	`1.5.2`

Description

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.

Recommendation

Update to bassmaster version 1.5.2 or greater.

NVD description

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2014-7205 · ADVISORY
hapijs/bassmaster commit b751602 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/96730 · WEB
GitHub Advisory GHSA-5j3g-jfq3-7jwx · ADVISORY
hapijs/bassmaster · PACKAGE
exploit-db.com/exploits/40689 · WEB
npmjs.com/advisories/1 · WEB
openwall.com/lists/oss-security/2014/09/30/10 · WEB
securityfocus.com/bid/70180 · WEB
nodesecurity.io/advisories/bassmaster_js_injection · Third Party Advisory
exploit-db.com/exploits/40689 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free