Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code     Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an     attacker to execute arbitrary code through crafted payloads. (CVE-2019-19919)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, HandlebarsJS on the remote server is prior to 4.3.0. Therefore, it may be affected by a Prototype Pollution vulnerability leading to Remote Code Execution when attackers supply crafted templates which alter a Objects __proto__ and __defineGetter__ properties.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Severity
250365	Linux Distros Unpatched Vulnerability : CVE-2019-19919	Nessus	Misc.	critical
114097	HandlebarsJS < 4.3.0 Prototype Pollution	Web App Scanning	Component Vulnerability	critical
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	critical

Detections

Analytics

CVE-2019-19919

critical

Tenable Plugins

critical

critical

critical