CVE-2014-7205

Published: Oct 8, 2014Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.

Affected (1)

Products: Bassmaster Project: Bassmaster

Bassmaster Project

1 product

Bassmaster

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bassmaster Project Bassmaster	Before 1.5.2

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://www.openwall.com/lists/oss-security/2014/09/30/10

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/70180

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/96730

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/hapijs/bassmaster/commit/b751602d8cb7194ee62a61e085069679525138c4

Source: cve@mitre.org

Exploit

https://nodesecurity.io/advisories/bassmaster_js_injection

Source: cve@mitre.org

Third Party Advisory

https://www.exploit-db.com/exploits/40689/

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2014/09/30/10