CVE-2017-1000188: XSS
Published Nov 17, 2017
·Updated
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Other sources
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Affected Software
2 affected componentsFixes available
npm/ejs<2.5.5
2.5.5
ejs ejs<2.5.5
Remediation
Event History
Nov 17, 2017
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Nov 30, 2017
Advisory Published
11:15 PM
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-1000188.
2
What is the severity of CVE-2017-1000188?
The severity of CVE-2017-1000188 is medium with a severity value of 6.1.
3
Which software versions are affected by CVE-2017-1000188?
Node.js ejs versions older than 2.5.5 are affected by CVE-2017-1000188.
4
How can the vulnerability be exploited?
The vulnerability can be exploited through a cross-site scripting (XSS) attack in the `ejs.renderFile()` function, allowing for code injection.
5
How can I fix CVE-2017-1000188?
To fix CVE-2017-1000188, update Node.js ejs to version 2.5.5 or newer.