CVE-2023-28154 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-28154 Interim 1 10 2025-02-16T02:17:42Z current 2023-03-21T00:14:57Z 2025-02-16T02:17:42Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-28154 Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 9 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 openSUSE Tumbleweed agama-web-ui-9+52-1.1 cockpit cockpit-agama-2.1+0-1.1 cockpit-bridge cockpit-d-installer-0.8.1~1-5.1 cockpit-dashboard cockpit-machines cockpit-networkmanager cockpit-podman cockpit-selinux cockpit-storaged cockpit-system cockpit-tukit cockpit-ws pcs-0.11.3-4.el9_1.3 pcs-snmp-0.11.3-4.el9_1.3 pcs-0.11.3-4.el9_1.3 as a component of SUSE Liberty Linux 9 pcs-snmp-0.11.3-4.el9_1.3 as a component of SUSE Liberty Linux 9 agama-web-ui-9+52-1.1 as a component of openSUSE Tumbleweed cockpit-agama-2.1+0-1.1 as a component of openSUSE Tumbleweed cockpit-d-installer-0.8.1~1-5.1 as a component of openSUSE Tumbleweed cockpit as a component of SUSE Linux Enterprise Micro 5.1 cockpit-bridge as a component of SUSE Linux Enterprise Micro 5.1 cockpit-dashboard as a component of SUSE Linux Enterprise Micro 5.1 cockpit-system as a component of SUSE Linux Enterprise Micro 5.1 cockpit-ws as a component of SUSE Linux Enterprise Micro 5.1 cockpit-podman as a component of SUSE Linux Enterprise Micro 5.1 cockpit as a component of SUSE Linux Enterprise Micro 5.2 cockpit-bridge as a component of SUSE Linux Enterprise Micro 5.2 cockpit-system as a component of SUSE Linux Enterprise Micro 5.2 cockpit-ws as a component of SUSE Linux Enterprise Micro 5.2 cockpit-machines as a component of SUSE Linux Enterprise Micro 5.2 cockpit-podman as a component of SUSE Linux Enterprise Micro 5.2 cockpit-tukit as a component of SUSE Linux Enterprise Micro 5.2 cockpit as a component of SUSE Linux Enterprise Micro 5.3 cockpit-bridge as a component of SUSE Linux Enterprise Micro 5.3 cockpit-networkmanager as a component of SUSE Linux Enterprise Micro 5.3 cockpit-selinux as a component of SUSE Linux Enterprise Micro 5.3 cockpit-storaged as a component of SUSE Linux Enterprise Micro 5.3 cockpit-system as a component of SUSE Linux Enterprise Micro 5.3 cockpit-ws as a component of SUSE Linux Enterprise Micro 5.3 cockpit-machines as a component of SUSE Linux Enterprise Micro 5.3 cockpit-podman as a component of SUSE Linux Enterprise Micro 5.3 cockpit-tukit as a component of SUSE Linux Enterprise Micro 5.3 cockpit as a component of SUSE Linux Enterprise Micro 5.4 cockpit-bridge as a component of SUSE Linux Enterprise Micro 5.4 cockpit-networkmanager as a component of SUSE Linux Enterprise Micro 5.4 cockpit-selinux as a component of SUSE Linux Enterprise Micro 5.4 cockpit-storaged as a component of SUSE Linux Enterprise Micro 5.4 cockpit-system as a component of SUSE Linux Enterprise Micro 5.4 cockpit-ws as a component of SUSE Linux Enterprise Micro 5.4 cockpit-machines as a component of SUSE Linux Enterprise Micro 5.4 cockpit-podman as a component of SUSE Linux Enterprise Micro 5.4 cockpit-tukit as a component of SUSE Linux Enterprise Micro 5.4 Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. CVE-2023-28154 SUSE Liberty Linux 9:pcs-0.11.3-4.el9_1.3 SUSE Liberty Linux 9:pcs-snmp-0.11.3-4.el9_1.3 openSUSE Tumbleweed:agama-web-ui-9+52-1.1 openSUSE Tumbleweed:cockpit-agama-2.1+0-1.1 openSUSE Tumbleweed:cockpit-d-installer-0.8.1~1-5.1 SUSE Linux Enterprise Micro 5.1:cockpit SUSE Linux Enterprise Micro 5.1:cockpit-bridge SUSE Linux Enterprise Micro 5.1:cockpit-dashboard SUSE Linux Enterprise Micro 5.1:cockpit-podman SUSE Linux Enterprise Micro 5.1:cockpit-system SUSE Linux Enterprise Micro 5.1:cockpit-ws SUSE Linux Enterprise Micro 5.2:cockpit SUSE Linux Enterprise Micro 5.2:cockpit-bridge SUSE Linux Enterprise Micro 5.2:cockpit-machines SUSE Linux Enterprise Micro 5.2:cockpit-podman SUSE Linux Enterprise Micro 5.2:cockpit-system SUSE Linux Enterprise Micro 5.2:cockpit-tukit SUSE Linux Enterprise Micro 5.2:cockpit-ws SUSE Linux Enterprise Micro 5.3:cockpit SUSE Linux Enterprise Micro 5.3:cockpit-bridge SUSE Linux Enterprise Micro 5.3:cockpit-machines SUSE Linux Enterprise Micro 5.3:cockpit-networkmanager SUSE Linux Enterprise Micro 5.3:cockpit-podman SUSE Linux Enterprise Micro 5.3:cockpit-selinux SUSE Linux Enterprise Micro 5.3:cockpit-storaged SUSE Linux Enterprise Micro 5.3:cockpit-system SUSE Linux Enterprise Micro 5.3:cockpit-tukit SUSE Linux Enterprise Micro 5.3:cockpit-ws SUSE Linux Enterprise Micro 5.4:cockpit SUSE Linux Enterprise Micro 5.4:cockpit-bridge SUSE Linux Enterprise Micro 5.4:cockpit-machines SUSE Linux Enterprise Micro 5.4:cockpit-networkmanager SUSE Linux Enterprise Micro 5.4:cockpit-podman SUSE Linux Enterprise Micro 5.4:cockpit-selinux SUSE Linux Enterprise Micro 5.4:cockpit-storaged SUSE Linux Enterprise Micro 5.4:cockpit-system SUSE Linux Enterprise Micro 5.4:cockpit-tukit SUSE Linux Enterprise Micro 5.4:cockpit-ws important 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H