Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code
    Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an
    attacker to execute arbitrary code through crafted payloads. (CVE-2019-19919)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code     Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an     attacker to execute arbitrary code through crafted payloads. (CVE-2019-19919)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version number, HandlebarsJS on the remote server is prior to 4.3.0. Therefore, it may be affected by a Prototype Pollution vulnerability leading to Remote Code Execution when attackers supply crafted templates which alter a Objects __proto__ and __defineGetter__ properties.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Type	Severity
474331	Chainguard: gitlab-rails-ce-assets-fips-19.4: security update to 19.4.0-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
474331	Chainguard: gitlab-rails-ce-assets-fips-19.4: security update to 19.4.0-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
250365	Linux Distros Unpatched Vulnerability : CVE-2019-19919	Nessus	Misc.	Local	critical
422558	SCA: security update for handlebars (GHSA-w457-6q6x-cgp9)	Tenable Cloud Security	SCA Checks	Local	critical
422558	SCA: security update for handlebars (GHSA-w457-6q6x-cgp9)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
114097	HandlebarsJS < 4.3.0 Prototype Pollution	Web App Scanning	Component Vulnerability	Version Based	critical
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	Combined	critical

Detections

Analytics

CVE-2019-19919

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical