Description
Underscore JavaScript Package 存在任意代码注入漏洞。该漏洞是由于未对变量参数做有效的校验导致的。
Underscore JavaScript Package 任意代码注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2021-23358
https://github.com/advisories/GHSA-cf4h-3jhx-xvhq
https://security.snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
https://www.sentinelone.com/vulnerability-database/cve-2021-23358/
https://www.acunetix.com/vulnerabilities/web/underscore-js-improper-control-of-generation-of-code-code-injection-vulnerability-cve-2021-23358/
https://www.tenable.com/plugins/was/112982
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
https://jira.atlassian.com/browse/CONFSERVER-74276
https://www.tenablecloud.cn/plugins/was/112982
https://cve.imfht.com/detail/CVE-2021-23358