Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

同学,您这个项目引入了483个开源组件,存在9个漏洞,辛苦升级一下 #1

Closed
ghost opened this issue Mar 12, 2022 · 0 comments
Labels
good first issue Good for newcomers

Comments

@ghost
Copy link

ghost commented Mar 12, 2022

检测到 Mkild/dental-admin-api 一共引入了483个开源组件,存在9个漏洞

漏洞标题:nodejs ejs远程代码执行漏洞
缺陷组件:ejs@2.3.4
漏洞编号:CVE-2017-1000228
漏洞描述:nodejs ejs是一款嵌入式JavaScript模板,它具有流量控制、自定义分隔符和转义输出等功能。

nodejs ejs 2.5.3之前的版本中的‘ejs.renderFile()’函数存在远程代码执行漏洞,该漏洞源于较弱的输入验证。远程攻击者可利用该漏洞执行代码。 
国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2017-36621
影响范围:(∞, 2.5.3)
最小修复版本:2.5.3
缺陷组件引入路径:koa2app@1.0.0->ejs@2.3.4

另外还有9个漏洞,详细报告:https://mofeisec.com/jr?p=a1c537

@Mkild Mkild added the good first issue Good for newcomers label Mar 12, 2022
@Mkild Mkild closed this as completed Mar 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant