Home > Vulnerability Database > CVE-2024-33883

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-33883

Good to know:

Date: April 27, 2024

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Language: JS

Severity Score

8.8

Related Resources (8)

Url: https://security.netapp.com/advisory/ntap-20240605-0003

Url: https://github.com/mde/ejs/compare/v3.1.9...v3.1.10

Url: https://security.netapp.com/advisory/ntap-20240605-0003/

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-33883

Url: https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5

Url: https://security-tracker.debian.org/tracker/CVE-2024-33883

Url: https://github.com/mde/ejs

Url: https://www.mend.io/vulnerability-database/CVE-2024-33883

Severity Score

8.8

Weakness Type (CWE)

Protection Mechanism Failure

CWE-693

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version ejs - 3.1.10;ejs - 3.1.10

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us