What’s Vulnerable › Vulnerabilities

CVE-2021-23337: Command Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-15 · updated 2026-10-08
• Weakness: CWE-94

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Affected products

• lodash: before 4.17.21 — fixed in 4.17.21
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• Cloud Manager: all versions
• NetApp System Manager: 9.0
• Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Extensibility Workbench: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
• Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Communications Cloud Native Core Binding Support Function: 1.9.0
• Oracle Communications Cloud Native Core Policy: 1.11.0
• Oracle Communications Design Studio: 7.4.2.0.0
• Oracle Communications Services Gatekeeper: 7.0
• Oracle Corporation Communications Session Border Controller: 8.4, 9.0
• Oracle Corporation Enterprise Communications Broker: 3.2.0, 3.3.0
• Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
• Oracle Corporation Health Sciences Data Management Workbench: 2.5.2.1, 3.0.0.0
• Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.1 — fixed in 9.2.6.1
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
• Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.12; from 19.12.0 through 19.12.11; from 20.12.0 through 20.12.7
• Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
• Oracle Corporation Retail Customer Management and Segmentation Foundation: 19.0
• Siemens SINEC INS: before 1.0; 1.0, 1.0-sp1 — fixed in 1.0
• Npm Lodash: before 4.17.21 — fixed in 4.17.21
• Npm Lodash-Es: before 4.17.21 — fixed in 4.17.21
• Npm Lodash-Template: through 1.0.0
• Npm Lodash.Template: through 4.5.0
• Rubygems Lodash-Rails: before 4.17.21; 0.10.0, 0.7.0, 0.8.1, 0.8.2, 0.9.0, 0.9.1 (+49) — fixed in 4.17.21

How to fix

Upgrade to a fixed version: lodash 4.17.21; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.1; Siemens SINEC INS 1.0; Npm Lodash 4.17.21; Npm Lodash-Es 4.17.21; Rubygems Lodash-Rails 4.17.21. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
• https://security.netapp.com/advisory/ntap-20210312-0006/
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
• https://snyk.io/vuln/SNYK-JS-LODASH-1040724
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2021-23337 or the next vulnerability affects your stack