CVE-2021-23337

nvd nist nuclei

Published: Feb 15, 2021Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Affected (48)

Products: Lodash: Lodash · Oracle: Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Extensibility Workbench, Banking Supply Chain Finance, Banking Trade Finance Process Management, Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Policy, Communications Design Studio, Communications Services Gatekeeper, Communications Session Border Controller, Enterprise Communications Broker, Financial Services Crime And Compliance Management Studio, Health Sciences Data Management Workbench, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools, Primavera Gateway, Primavera Unifier, Retail Customer Management And Segmentation Foundation · Netapp: Active Iq Unified Manager, Cloud Manager, System Manager · +1 more

Show all products

1 product

18 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Extensibility Workbench

Banking Supply Chain Finance

Banking Trade Finance Process Management

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Policy

Communications Design Studio

Communications Services Gatekeeper

Communications Session Border Controller

Enterprise Communications Broker

Financial Services Crime And Compliance Management Studio

Health Sciences Data Management Workbench

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Primavera Gateway

Primavera Unifier

Retail Customer Management And Segmentation Foundation

3 products

Active Iq Unified Manager

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lodash Lodash	Before 4.17.21

Configuration B

39 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.2.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.5.0
Oracle Banking Credit Facilities Process Management	Version 14.2.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.5.0
Oracle Banking Extensibility Workbench	Version 14.2.0
Oracle Banking Extensibility Workbench	Version 14.3.0
Oracle Banking Extensibility Workbench	Version 14.5.0
Oracle Banking Supply Chain Finance	Version 14.2.0
Oracle Banking Supply Chain Finance	Version 14.3.0
Oracle Banking Supply Chain Finance	Version 14.5.0
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Communications Cloud Native Core Binding Support Function	Version 1.9.0
Oracle Communications Cloud Native Core Policy	Version 1.11.0
Oracle Communications Design Studio	Version 7.4.2.0.0
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Session Border Controller	Version 8.4
Oracle Communications Session Border Controller	Version 9.0
Oracle Enterprise Communications Broker	Version 3.2.0
Oracle Enterprise Communications Broker	Version 3.3.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.2.0
Oracle Financial Services Crime And Compliance Management Studio	Version 8.0.8.3.0
Oracle Health Sciences Data Management Workbench	Version 2.5.2.1
Oracle Health Sciences Data Management Workbench	Version 3.0.0.0
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.6.1
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Gateway	From 17.12.0 to 17.12.11
Oracle Primavera Gateway	From 18.8.0 to 18.8.12
Oracle Primavera Gateway	From 19.12.0 to 19.12.11
Oracle Primavera Gateway	From 20.12.0 to 20.12.7
Oracle Primavera Unifier	From 17.7 to 17.12
Oracle Primavera Unifier	Version 18.8
Oracle Primavera Unifier	Version 19.12
Oracle Primavera Unifier	Version 20.12
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Manager	All versions
Netapp System Manager	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Ins	Before 1.0
Siemens Sinec Ins	Version 1.0
Siemens Sinec Ins	Version 1.0 sp1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (26)

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851

Source: report@snyk.io

Broken Link

https://security.netapp.com/advisory/ntap-20210312-0006/

Source: report@snyk.io

Third Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-LODASH-1040724

Source: report@snyk.io

ExploitThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: report@snyk.io

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: report@snyk.io

PatchThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://security.netapp.com/advisory/ntap-20210312-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-LODASH-1040724

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.