CVEFinder.io

CVE-2021-23337

⚠️ high
🔍 Scan for this CVE
Summary

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS Score
7.2
High
EPSS Score
21.3
Exploit Probability
Published Date
2021-02-15
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 54.3% of all 365,863 vulnerabilities in our database.

#167,172
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Oct 8, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Marc Hassan
SSVC data provided by CISA
Last Modified 2026-10-08
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-94

📦 Affected Products 45

Vendor Product Status Affected Versions
oracle peoplesoft_enterprise_peopletools Affected
v8.58
oracle peoplesoft_enterprise_peopletools Affected
v8.59
netapp system_manager Affected
v9.0
oracle jd_edwards_enterpriseone_tools Affected
< 9.2.6.1
oracle retail_customer_management_and_segmentation_foundation Affected
v19.0
oracle communications_services_gatekeeper Affected
v7.0
oracle health_sciences_data_management_workbench Affected
v2.5.2.1
oracle health_sciences_data_management_workbench Affected
v3.0.0.0
oracle primavera_gateway Affected
≥ 17.12.0 ≤ 17.12.11
oracle primavera_gateway Affected
≥ 18.8.0 ≤ 18.8.12
oracle primavera_gateway Affected
≥ 19.12.0 ≤ 19.12.11
oracle primavera_gateway Affected
≥ 20.12.0 ≤ 20.12.7
oracle primavera_unifier Affected
≥ 17.7 ≤ 17.12
oracle primavera_unifier Affected
v18.8
oracle primavera_unifier Affected
v19.12
oracle primavera_unifier Affected
v20.12
oracle communications_session_border_controller Affected
v8.4
oracle communications_session_border_controller Affected
v9.0
lodash lodash Affected
< 4.17.21
netapp active_iq_unified_manager Affected
v-
oracle enterprise_communications_broker Affected
v3.2.0
oracle enterprise_communications_broker Affected
v3.3.0
oracle banking_extensibility_workbench Affected
v14.2.0
oracle banking_extensibility_workbench Affected
v14.3.0
oracle banking_extensibility_workbench Affected
v14.5.0
oracle communications_design_studio Affected
v7.4.2.0.0
oracle banking_corporate_lending_process_management Affected
v14.2.0
oracle banking_corporate_lending_process_management Affected
v14.3.0
oracle banking_corporate_lending_process_management Affected
v14.5.0
oracle banking_trade_finance_process_management Affected
v14.2.0
oracle banking_trade_finance_process_management Affected
v14.3.0
oracle banking_trade_finance_process_management Affected
v14.5.0
oracle banking_credit_facilities_process_management Affected
v14.2.0
oracle banking_credit_facilities_process_management Affected
v14.3.0
oracle banking_credit_facilities_process_management Affected
v14.5.0
netapp cloud_manager Affected
v-
oracle communications_cloud_native_core_policy Affected
v1.11.0
oracle banking_supply_chain_finance Affected
v14.2.0
oracle banking_supply_chain_finance Affected
v14.3.0
oracle banking_supply_chain_finance Affected
v14.5.0
oracle communications_cloud_native_core_binding_support_function Affected
v1.9.0
siemens sinec_ins Affected
< 1.0
siemens sinec_ins Affected
v1.0
oracle financial_services_crime_and_compliance_management_studio Affected
v8.0.8.2.0
oracle financial_services_crime_and_compliance_management_studio Affected
v8.0.8.3.0

🔗 References 13

https://cert-portal.siemens.com/productcert/pdf/ssa-...
Patch Third Party Advisory
https://github.com/lodash/lodash/blob/ddfd9b11a0126d...
Broken Link
https://security.netapp.com/advisory/ntap-20210312-0...
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUB...
Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-1040724
Exploit Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-83014 ⚠️ high 8.1 0.4 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supporte... 2026-09-15
CVE-2026-83015 ⚠️ high 7.0 0.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supporte... 2026-09-15
CVE-2026-83016 ⚠️ high 7.2 0.1 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported version... 2026-09-15
CVE-2026-83017 ⚠️ high 8.8 0.4 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). S... 2026-09-15
CVE-2026-83018 ⚠️ high 7.8 0.2 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported version... 2026-09-15
CVE-2026-83019 ⚠️ high 8.1 0.4 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported version... 2026-09-15
These CVEs affect the same products