CVE-2021-23389

EUVD-2021-2469
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snykCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
totaljstotal.js
𝑥
< 3.4.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631
https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607
https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631
https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607