9.8
CVSSv3

CVE-2022-29078

Published: 25/04/2022 Updated: 08/08/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 670
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

ejs ejs 3.1.6

Vendor Advisories

Debian Bug report logs - #1010359 node-ejs: CVE-2022-29078 server-side template injection Package: src:node-ejs; Maintainer for src:node-ejs is Debian Javascript Maintainers <pkg-javascript-devel@listsaliothdebianorg>; Reported by: Neil Williams <codehelp@debianorg> Date: Fri, 29 Apr 2022 13:27:01 UTC Severity: i ...

Github Repositories

Sample Express JS node application

VulnExpress demo Overview This a demo Express JS application to illustrate how a critical vulnerability can be exploited and how it could have been detected and remediated using Jfrog Advanced Security new features Build the project and the docker image Build the project npm install Run it locally npm start Build the docker image docker build -t vuln-ejs:latest Run it d

Sample Express JS app to show the risk of vulnerabilities

VulnExpress Overview This a demo Express JS application to illustrate how a critical vulnerability can be exploited and how it could have been detected and remediated using Jfrog Advanced Security new features Build the project and the docker image Build the project npm install Run it locally npm start Build the docker image docker build -t vuln-ejs:latest Run it docker

VulnExpress demo Overview This a demo Express JS application to illustrate how a critical vulnerability can be exploited and how it could have been detected and remediated using Jfrog Advanced Security new features Build the project and the docker image Build the project npm install Run it locally npm start Build the docker image docker build -t vuln-ejs:latest Run it do

VulnExpress demo Overview This a demo Express JS application to illustrate how a critical vulnerability can be exploited and how it could have been detected and remediated using Jfrog Advanced Security new features Build the project and the docker image Build the project npm install Run it locally npm start Build the docker image docker build -t vuln-ejs:latest Run it d

vuln ejs 3.1.6 docker

CVE-2022-29078 vuln ejs 316 docker Setup git clone githubcom/miko550/CVE-2022-29078git cd CVE-2022-29078 docker build -t miko/vuln-ejs docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs Usage 127001:49160/ Exploit In browser 127001:49160/page?id=2&s

DevSecOps Days demo Overview This a demo Express JS application to illustrate how a critical vulnerability can be exploited and how it could have been detected and remediated using Jfrog Advanced Security Build the project and the docker image Build the project npm install Run it locally npm start Build the docker image docker build -t vuln-ejs:latest Run it docker run -

Application proposant des challenges en cybersécurité

Les CTFs de Cyrhades Accès au discord : discordgg/FkFh55qcBz 🎉 🥳 Nouvelle version en Java 🥳 🎉 Vidéo de Présentation Regardez la vidéo Des challenges seront ajoutés réguliérement (environ 1 par semaine) Bon challenges à tous ! Concernant cette nouvelle version il n'y a aucun CTF d'int&eacut