Vulnerability Details : CVE-2023-28154
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Products affected by CVE-2023-28154
- cpe:2.3:a:webpack.js:webpack:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-28154
0.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-28154
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
References for CVE-2023-28154
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AU7BOXTBK3KDYSWH67ASZ22TUIOZ3X5G/
[SECURITY] Fedora 36 Update: pcs-0.11.5-2.fc36 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPSAXUTXBCCTAHTCX5BUR4YVP25XALQ3/
[SECURITY] Fedora 38 Update: pcs-0.11.5-2.fc38 - package-announce - Fedora Mailing-Lists
-
https://github.com/webpack/webpack/pull/16500
security: avoid cross-realm objects by Jack-Works · Pull Request #16500 · webpack/webpack · GitHubPatch
-
https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0
Comparing v5.75.0...v5.76.0 · webpack/webpack · GitHubPatch;Product
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2AFCM6FFE3LRYI6KNEQWKMXMQOBZQ2D/
[SECURITY] Fedora 37 Update: pcs-0.11.5-2.fc37 - package-announce - Fedora Mailing-Lists
Jump to