New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

同学，您这个项目引入了483个开源组件，存在9个漏洞，辛苦升级一下 #1

Closed

ghost opened this issue Mar 12, 2022 · 0 comments

Labels

good first issue

ghost commented Mar 12, 2022

检测到 Mkild/dental-admin-api 一共引入了483个开源组件，存在9个漏洞

漏洞标题：nodejs ejs远程代码执行漏洞
缺陷组件：ejs@2.3.4
漏洞编号：CVE-2017-1000228
漏洞描述：nodejs ejs是一款嵌入式JavaScript模板，它具有流量控制、自定义分隔符和转义输出等功能。

nodejs ejs 2.5.3之前的版本中的‘ejs.renderFile()’函数存在远程代码执行漏洞，该漏洞源于较弱的输入验证。远程攻击者可利用该漏洞执行代码。 
国家漏洞库信息：https://www.cnvd.org.cn/flaw/show/CNVD-2017-36621
影响范围：(∞, 2.5.3)
最小修复版本：2.5.3
缺陷组件引入路径：koa2app@1.0.0->ejs@2.3.4

另外还有9个漏洞，详细报告：https://mofeisec.com/jr?p=a1c537

The text was updated successfully, but these errors were encountered:

Mkild added the good first issue label

Mkild closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment