9.8

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Data is provided by the National Vulnerability Database (NVD)
Handlebars.Js Project ≫ Handlebars.Js Version1.0.6 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.7 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.8 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.9 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.10 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.11 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.0.12 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.1.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.1.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.1.2 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.2.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.2.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version1.3.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version2.0.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.2 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.3 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.4 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.5 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.6 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version3.0.7 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.2 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.3 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.4 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.5 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.6 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.7 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.8 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.9 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.10 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.11 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.12 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.13 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.0.14 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.1.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.1.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.1.2 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.2.0 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.2.1 Update- SwPlatformnode.js
Handlebars.Js Project ≫ Handlebars.Js Version4.2.2 Update- SwPlatformnode.js
Tenable ≫ Tenable.Sc Version < 5.19.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 24.75% 0.959
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.