CVE-2017-1000228
critical
CVSS v3
9.8
CVSS v2
10.0
VIR risk
9.8
Description
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-1000228
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 2.5.7-1 |
| debian | bullseye | fixed | 2.5.7-1 |
| debian | forky | fixed | 2.5.7-1 |
| debian | sid | fixed | 2.5.7-1 |
| debian | trixie | fixed | 2.5.7-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | ejs | <2.5.5 | 2.5.5 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ejs | ejs | {"endExcluding":"2.5.3"} | 2.5.3 |
References
- http://www.securityfocus.com/bid/101897
- https://snyk.io/vuln/npm:ejs:20161128
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000228
- https://github.com/advisories/GHSA-3w5v-p54c-f74x
- https://web.archive.org/web/20171123041219/http://www.securityfocus.com/bid/101897
- https://security-tracker.debian.org/tracker/CVE-2017-1000228
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.