Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVqM2ctamZxMy03and4

Arbitrary JavaScript Execution in bassmaster

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.

Recommendation

Update to bassmaster version 1.5.2 or greater.

Permalink: https://github.com/advisories/GHSA-5j3g-jfq3-7jwx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVqM2ctamZxMy03and4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 6 years ago
Updated: over 1 year ago

Identifiers: GHSA-5j3g-jfq3-7jwx, CVE-2014-7205
References:

• https://nvd.nist.gov/vuln/detail/CVE-2014-7205
• https://github.com/hapijs/bassmaster/commit/b751602d8cb7194ee62a61e085069679525138c4
• https://github.com/advisories/GHSA-5j3g-jfq3-7jwx
• https://www.npmjs.com/advisories/1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96730
• https://www.exploit-db.com/exploits/40689/
• http://www.openwall.com/lists/oss-security/2014/09/30/10
• http://www.securityfocus.com/bid/70180

Repository: https://github.com/hapijs/bassmaster
Blast Radius: 0.0

Affected Packages