CVE-2014-7205

描述

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval. ## Recommendation Update to bassmaster version 1.5.2 or greater.

如何修補 CVE-2014-7205

要修補 CVE-2014-7205,請將受影響套件升級到下列已修補版本。

• npm/bassmaster—升級至 1.5.2 或更新版本

CVE-2014-7205 正在被利用嗎?

可能 — EPSS 為 78.6%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• from 0, < 1.5.2

參考連結(9)

• ADVISORYgithub.com/advisories/GHSA-5j3g-jfq3-7jwx
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-7205
• PATCHgithub.com/hapijs/bassmaster
• WEBwww.openwall.com/lists/oss-security/2014/09/30/10
• WEBwww.securityfocus.com