CVE-2014-7205 Arbitrary JavaScript Execution in bassmaster
HighCVSS 10.0
EPSS 78.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm bassmaster(npm) | < 1.5.2 | 1.5.2 |
| bassmaster project bassmaster | < 1.5.2 | 1.5.2 |
References
- nvd.nist.gov third-party-advisory
- github.com exploit patch
- github.com
- www.npmjs.com
- bassmaster-cve20147205-code-exec(96730) third-party-advisory vdb-entry
- 40689 exploit third-party-advisory vdb-entry
- [oss-security] 20140924 Re: CVE request: various NodeJS module vulnerabilities mailing-list third-party-advisory
- 70180 third-party-advisory vdb-entry
- nodesecurity.io third-party-advisory