CVE-2023-29827 - High Severity Vulnerability

[kishore0549]

Vulnerable Library - ejs-3.1.9.tgz
Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

ibmcloud-appid-7.0.0.tgz (Root Library)
❌ ejs-3.1.9.tgz (Vulnerable Library)
Found in base branch: master

Vulnerability Details
ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

Publish Date: 2023-05-04

URL: CVE-2023-29827

CVSS 3 Score Details (8.8)
Base Score Metrics:

Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here.

[Sushma-t-n]

WhiteSource mend has reported above vulnerability for ibmcloud-appid package, any updates on the above or with what functionality we are vulnerable?