Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2024-33883 (High) detected in ejs-3.1.7.tgz #6769

Closed
mend-for-github-com bot opened this issue May 10, 2024 · 0 comments
Closed

CVE-2024-33883 (High) detected in ejs-3.1.7.tgz #6769

mend-for-github-com bot opened this issue May 10, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

CVE-2024-33883 - High Severity Vulnerability

Vulnerable Library - ejs-3.1.7.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

  • @osd/plugin-generator-1.0.0.tgz (Root Library)
    • ❌ ejs-3.1.7.tgz (Vulnerable Library)

Found in HEAD commit: d920951800978f8e66da6e0d1c5347d1c029c28c

Found in base branch: main

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Publish Date: 2024-04-28

URL: CVE-2024-33883

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883

Release Date: 2024-04-28

Fix Resolution: ejs - 3.1.10
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label May 10, 2024
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue May 10, 2024
@ananzh
[CVE-2024-33883] Bump ejs from to
b73ea03 
Issue Resolved
opensearch-project#6769

Signed-off-by: Anan Zhuang <[email protected]>
@ananzh ananzh mentioned this issue May 10, 2024
Merged
7 tasks
bandinib-amzn pushed a commit to ananzh/OpenSearch-Dashboards that referenced this issue May 28, 2024
@ananzh @bandinib-amzn
[CVE-2024-33883] Bump ejs from to
9e43c7b 
Issue Resolved
opensearch-project#6769

Signed-off-by: Anan Zhuang <[email protected]>
@ananzh ananzh closed this as completed in 016dcfd Jun 4, 2024
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue Jun 5, 2024
@ananzh
[2.x Manual Backport][CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10
99a25f3 
Backport PR
opensearch-project#6770

Issue Resolved
opensearch-project#6769

Signed-off-by: Anan Zhuang <[email protected]>
@ananzh ananzh mentioned this issue Jun 5, 2024
Merged
7 tasks
BionIT pushed a commit that referenced this issue Jun 5, 2024
@ananzh
[2.x Manual Backport][CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 (#…
f06b6aa 
…6924)

Backport PR
#6770

Issue Resolved
#6769

Signed-off-by: Anan Zhuang <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants