Vulnerability · Published Mar 1, 2022 · Assigned by GitHub_M

CVE-2022-24718Path Traversal in ssr-pages

High 7.6

In plain English

A high-severity path traversal in ssr-pages from Finastra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)1.1%top 33.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@finastra/ssr-pages	0.1.4	GHSA-w6cx-qg2q-rvq8

Affected products (as reported)

Vendor	Product	Versions
Finastra	ssr-pages	< 0.1.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8 x_refsource_CONFIRM
https://github.com/Finastra/ssr-pages/pull/1 x_refsource_MISC
https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780 x_refsource_MISC