VulnerabilityModified
CVE-2021-23337
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
HIGH 7.2EPSS 21.3%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 21.33% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- lodash/lodash · oracle/banking corporate lending process management · oracle/banking credit facilities process management · oracle/banking extensibility workbench · oracle/banking supply chain finance · oracle/banking trade finance process management · oracle/communications cloud native core binding support function · oracle/communications cloud native core policy · oracle/communications design studio · oracle/communications services gatekeeper · oracle/communications session border controller · oracle/enterprise communications broker · oracle/financial services crime and compliance management studio · oracle/health sciences data management workbench · oracle/jd edwards enterpriseone tools · oracle/peoplesoft enterprise peopletools · oracle/primavera gateway · oracle/primavera unifier · oracle/retail customer management and segmentation foundation · netapp/active iq unified manager · +3 more
- Source
- report@snyk.io
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfPatch, Third Party Advisory
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851Broken Link
- https://security.netapp.com/advisory/ntap-20210312-0006/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdfPatch, Third Party Advisory
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851Broken Link
- https://security.netapp.com/advisory/ntap-20210312-0006/Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724Exploit, Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.