CVE:CVE-2019-19919
CNNVD:CNNVD-201912-981
handlebars是一款语义化的Web模板系统。
handlebars 4.3.0之前版本中存在注入漏洞。攻击者可借助特制的payloads利用该漏洞执行任意代码。
solution:Upgrade handlebars.js_project handlebars.js to a higher version than 1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.1.0,1.1.1,1.1.2,1.2.0,1.2.1,1.3.0,2.0.0,3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.1.0,4.1.1,4.1.2,4.2.0,4.2.1,4.2.2,and avoid the version 1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.1.0,1.1.1,1.1.2,1.2.0,1.2.1,1.3.0,2.0.0,3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.1.0,4.1.1,4.1.2,4.2.0,4.2.1,4.2.2; Upgrade tenable tenable.sc to a higher version than 5.19.0,and avoid the version (,5.19.0)