opentok
ejs-3.1.5.tgz: 4 vulnerabilities (highest severity is: 9.8) reachable
Vulnerable Library - ejs-3.1.5.tgz
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Exploit Maturity | EPSS | Dependency | Type | Fixed in (ejs version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2022-3517 |  High |
7.5 | Not Defined | 0.5% | minimatch-3.0.4.tgz | Transitive | N/A* | ❌ |
|
| WS-2021-0153 |  Critical |
9.8 | Not Defined | ejs-3.1.5.tgz | Direct | 3.1.6 | ✅ |
|
|
| CVE-2022-29078 | Critical |
9.8 | Not Defined | 93.5% | ejs-3.1.5.tgz | Direct | 3.1.7 | ✅ |
|
| CVE-2024-33883 | High |
8.8 | Not Defined | 1.3000001% | ejs-3.1.5.tgz | Direct | ejs - 3.1.10 | ✅ |
|
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-3517
Vulnerable Library - minimatch-3.0.4.tgz
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/minimatch/package.json
Dependency Hierarchy:
- ejs-3.1.5.tgz (Root Library)
- jake-10.8.2.tgz
- :x: minimatch-3.0.4.tgz (Vulnerable Library)
- jake-10.8.2.tgz
Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907
Found in base branches: develop, master
Reachability Analysis
This vulnerability is potentially reachable
opentok-rtc-5.0.1/test/web/bower_components/mocha/mocha.js (Application)
-> glob-7.1.6/glob.js (Extension)
-> ❌ minimatch-3.0.4/minimatch.js (Vulnerable Component)
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.5%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-f8q6-p94x-37v3
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
WS-2021-0153
Vulnerable Library - ejs-3.1.5.tgz
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Dependency Hierarchy:
- :x: ejs-3.1.5.tgz (Vulnerable Library)
Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907
Found in base branches: develop, master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.
Publish Date: 2021-01-22
URL: WS-2021-0153
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-01-22
Fix Resolution: 3.1.6
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-29078
Vulnerable Library - ejs-3.1.5.tgz
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Dependency Hierarchy:
- :x: ejs-3.1.5.tgz (Vulnerable Library)
Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907
Found in base branches: develop, master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Publish Date: 2022-04-25
URL: CVE-2022-29078
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 93.5%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~
Release Date: 2022-04-25
Fix Resolution: 3.1.7
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-33883
Vulnerable Library - ejs-3.1.5.tgz
Embedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ejs/package.json
Dependency Hierarchy:
- :x: ejs-3.1.5.tgz (Vulnerable Library)
Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907
Found in base branches: develop, master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
Publish Date: 2024-04-28
URL: CVE-2024-33883
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.3000001%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883
Release Date: 2024-04-28
Fix Resolution: ejs - 3.1.10
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
![mend-for-github-com[bot] avatar](https://avatars.githubusercontent.com/in/30796?v=4 "Published by a pub.dev verified publisher"){kind=small}