What is GHSA-g7rj-q722-245g?

GHSA-g7rj-q722-245g is a security advisory published by GitHub Security Advisories with Critical severity. jsreport vulnerable to code injection

Which CVE IDs does GHSA-g7rj-q722-245g cover?

GHSA-g7rj-q722-245g covers the following CVE IDs: CVE-2023-2583. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g7rj-q722-245g?

GHSA-g7rj-q722-245g has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-g7rj-q722-245g?

GHSA-g7rj-q722-245g affects 1 product, including: npm/jsreport:\u003c 3.11.3.

GHSA-g7rj-q722-245gCriticalCVSS 10.0

jsreport vulnerable to code injection

Vendor

GitHub Security Advisories

Published

May 8, 2023

Last Modified

November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-2583 →

📋 Description

jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the user to attack the installed jsreport client.

🎯 Affected products1

npm/jsreport:< 3.11.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-2583
https://github.com/jsreport/jsreport/commit/afaff3804b34b38e959f5ae65f9e672088de13d7
https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96
https://github.com/jsreport/jsreport/releases/tag/3.11.3
https://github.com/advisories/GHSA-g7rj-q722-245g