CVE-2014-7205: Arbitrary JavaScript Execution in bassmaster
Summary
CVE-2014-7205: Arbitrary JavaScript Execution in bassmaster. Affects bassmaster versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bassmaster is an npm package that provides a RESTful API for Hapi.js, a rich framework for building applications and services. It allows developers to create and manage routes for handling HTTP requests. However, bassmaster versions up to 1.5.1 are vulnerable to an arbitrary JavaScript execution attack. This vulnerability enables an attacker to supply malicious JavaScript code that is then executed on the server side using the eval function.
Vulnerability Detail
The vulnerability in bassmaster <= 1.5.1 allows an attacker to inject arbitrary JavaScript code that is executed server-side through the eval function. This can lead to various security risks, including remote code execution, unauthorized access to sensitive data, and potential compromise of the entire server. The vulnerability is rated as critical and has been assigned the Common Weakness Enumeration (CWE) ID 94.
How To Fix
Minimum fixed version
1.5.2
This is the first release that contains the fix.
npm install bassmaster@1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bassmaster package up to version 1.5.1 is vulnerable to arbitrary JavaScript execution. To protect your application and mitigate the risk, it is essential to update to bassmaster version 1.5.2 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bassmaster →
FAQ
Bassmaster is an npm package that provides a RESTful API for Hapi.js, a framework for building applications and services.
The vulnerability allows an attacker to execute arbitrary JavaScript code on the server side, potentially leading to remote code execution, unauthorized access, and server compromise.
To fix the vulnerability, update bassmaster to version 1.5.2 or later.
No, the recommended fix is to update to the latest version of bassmaster.
There may be known exploits targeting this vulnerability. It is crucial to update to the latest version to mitigate the risk.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.