CVE-2017-5941
Code Execution through IIFE in node-serialize
描述
Affected versions of `node-serialize` can be abused to execute arbitrary code via an [immediately invoked function expression](https://en.wikipedia.org/wiki/Immediately-invoked_function_expression) (IIFE) if untrusted user input is passed into `unserialize()`. ## Recommendation There is no direct patch for this issue. The package author has reviewed this advisory, and provided the following recommendation: ``` To avoid the security issues, at least one of the following methods should be taken: 1. Make sure to send serialized strings internally, isolating them from potential hackers. For example, only sending the strings from backend to fronend and always using HTTPS instead of HTTP. 2. Introduce public-key cryptosystems (e.g. RSA) to ensure the strings not being tampered with. ```
如何修補 CVE-2017-5941
目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。
- —未列出修補版本
CVE-2017-5941 正在被利用嗎?
可能 — EPSS 為 61.0%,屬於高被利用機率區間,建議優先修補。
受影響套件(1)
- from 0, <= 0.0.4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |