CVE-2023-29827 (Critical) detected in ejs-2.5.9.tgz - autoclosed
Closed this issue · 1 comments
CVE-2023-29827 - Critical Severity Vulnerability
Vulnerable Library - ejs-2.5.9.tgz
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-2.5.9.tgz
Path to dependency file: /PrestaShop/tests/E2E/package.json
Path to vulnerable library: /tests/E2E/package.json
Dependency Hierarchy:
- webdriverio-4.14.4.tgz (Root Library)
- ❌ ejs-2.5.9.tgz (Vulnerable Library)
Found in HEAD commit: bb7465065dfeed9f49bb99b6901ab933563af739
Found in base branch: develop
Vulnerability Details
** DISPUTED ** ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.
Publish Date: 2023-05-04
URL: CVE-2023-29827
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.