May 4, 2023, 2:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

configuration cve file injection parameter server settings template template injection vulnerable

Sr. Product Manager

@ MixMode | Remote, US

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Security Analysis Senior Specialist

@ NTT DATA | singapore, 01, SG

Information Assurance Analyst - Security Architecture / Vulnerability Management

@ Hawaiian Electric | Honolulu, Hawaii (HI), US, 96840