PT-2021-7457 · Unknown+5 · Underscore+5
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
underscore versions 1.3.2 through 1.12.1
underscore versions 1.13.0-0 through 1.13.0-2
Description
The issue is related to the template function in the underscore library, which is used for working with arrays in JavaScript. It is caused by incorrect code generation management. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is specifically related to the template function when a variable property is passed as an argument without proper sanitization, leading to arbitrary code injection.
Recommendations
For underscore versions 1.3.2 through 1.12.1, update to a version outside of this range to mitigate the risk.
For underscore versions 1.13.0-0 through 1.13.0-2, update to version 1.13.0-2 or later to resolve the issue.
As a temporary workaround, consider disabling the template function until a patch is available.
Restrict access to the template function to minimize the risk of exploitation, especially when variable properties are passed as arguments.
Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Jira
Linuxmint
Suse
Ubuntu
Underscore