Lucene search

MitreCVE-2014-7205

HistoryOct 08, 2014 - 5:55 p.m.

CVE-2014-7205

2014-10-0817:55:05

CWE-94

mitre

web.nvd.nist.gov

cve

2014

7205

eval

injection

vulnerability

lib

batch.js

bassmaster

plugin

hapi

server

framework

node.js

javascript

code

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.895

Percentile

98.8%

JSON

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Affected configurations

Nvd

Node

bassmaster_projectbassmasterRange<1.5.2

VendorProductVersionCPE
bassmaster_projectbassmaster*cpe:2.3:a:bassmaster_project:bassmaster:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bassmaster_project	bassmaster	*	cpe:2.3:a:bassmaster_project:bassmaster::::::::

References

www.openwall.com/lists/oss-security/2014/09/30/10

www.securityfocus.com/bid/70180

exchange.xforce.ibmcloud.com/vulnerabilities/96730

github.com/hapijs/bassmaster/commit/b751602d8cb7194ee62a61e085069679525138c4

nodesecurity.io/advisories/bassmaster_js_injection

www.exploit-db.com/exploits/40689/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

Low

EPSS

0.895

Percentile

98.8%

JSON

Related for CVE-2014-7205