Strix
26.1K

CVE-2021-23337

HIGHCVSS 7.2/10EPSS 22.41%

Last modified

CVE-2021-23337 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.. EPSS estimates a 22.41% chance of exploitation in the next 30 days.

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Metrics

CVSS 3.1
7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
22.41%

97.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LodashLodash< 4.17.21
OracleBanking Corporate Lending Process Management14.2.0
OracleBanking Corporate Lending Process Management14.3.0
OracleBanking Corporate Lending Process Management14.5.0
OracleBanking Credit Facilities Process Management14.2.0
OracleBanking Credit Facilities Process Management14.3.0
OracleBanking Credit Facilities Process Management14.5.0
OracleBanking Extensibility Workbench14.2.0
OracleBanking Extensibility Workbench14.3.0
OracleBanking Extensibility Workbench14.5.0
OracleBanking Supply Chain Finance14.2.0
OracleBanking Supply Chain Finance14.3.0
OracleBanking Supply Chain Finance14.5.0
OracleBanking Trade Finance Process Management14.2.0
OracleBanking Trade Finance Process Management14.3.0
OracleBanking Trade Finance Process Management14.5.0
OracleCommunications Cloud Native Core Binding Support Function1.9.0
OracleCommunications Cloud Native Core Policy1.11.0
OracleCommunications Design Studio7.4.2.0.0
OracleCommunications Services Gatekeeper7.0
OracleCommunications Session Border Controller8.4
OracleCommunications Session Border Controller9.0
OracleEnterprise Communications Broker3.2.0
OracleEnterprise Communications Broker3.3.0
OracleFinancial Services Crime And Compliance Management Studio8.0.8.2.0
OracleFinancial Services Crime And Compliance Management Studio8.0.8.3.0
OracleHealth Sciences Data Management Workbench2.5.2.1
OracleHealth Sciences Data Management Workbench3.0.0.0
OracleJd Edwards Enterpriseone Tools< 9.2.6.1
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
OraclePrimavera Gateway>= 17.12.0, <= 17.12.11
OraclePrimavera Gateway>= 18.8.0, <= 18.8.12
OraclePrimavera Gateway>= 19.12.0, <= 19.12.11
OraclePrimavera Gateway>= 20.12.0, <= 20.12.7
OraclePrimavera Unifier>= 17.7, <= 17.12
OraclePrimavera Unifier18.8
OraclePrimavera Unifier19.12
OraclePrimavera Unifier20.12
OracleRetail Customer Management And Segmentation Foundation19.0
NetappActive Iq Unified ManagerAll versions
NetappCloud ManagerAll versions
NetappSystem Manager9.0
SiemensSinec Ins< 1.0
SiemensSinec Ins1.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-23337?
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
How severe is CVE-2021-23337?
CVE-2021-23337 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 22.41% probability of exploitation in the next 30 days.
How do I fix CVE-2021-23337?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-23337?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST