According to its self-reported version number, HandlebarsJS on the remote server is prior to 3.0.8 or 4.x prior to 4.5.3. Therefore, it may be affected by a arbitrary code execution vulnerability permitting attackers to submit templates that execute aribtrary Javascript either server-side on a server processing Handlebars templates, or in a victims browser.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5179 advisory.

  - nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript     execution (CVE-2019-20920)

  - nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS     (CVE-2019-20922)

  - nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114096	HandlebarsJS 4.x < 4.5.3 Arbitrary Code Execution	Web App Scanning	Component Vulnerability	10/24/2023	10/25/2023	high
114095	HandlebarsJS < 3.0.8 Arbitrary Code Execution	Web App Scanning	Component Vulnerability	10/24/2023	10/25/2023	high
143235	RHEL 8 : Red Hat Virtualization (RHSA-2020:5179)	Nessus	Red Hat Local Security Checks	11/24/2020	2/8/2024	high

Detections

Analytics

Plugins Search

high

high

high