Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
References
| Link | Resource |
|---|---|
| https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0 | Patch Product |
| https://github.com/webpack/webpack/pull/16500 | Patch |
Configurations
History
17 Mar 2023, 15:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/webpack/webpack/pull/16500 - Patch | |
| References | (MISC) https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0 - Patch, Product | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Webpack.js
Webpack.js webpack |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:* |
13 Mar 2023, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-13 01:15
Updated : 2023-03-17 15:19
NVD link : CVE-2023-28154
Mitre link : CVE-2023-28154
JSON object : View
Products Affected
webpack.js
- webpack
CWE