PT-2022-16826 · Ssr-Pages · Ssr-Pages

Published 2022-03-01 · Updated 2022-03-09 · CVE-2022-24718

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions ssr-pages versions prior to 0.1.4

Description ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). A path traversal issue can occur when providing untrusted input to the svg property as an argument to the build(MessagePageOptions) function.

Recommendations For versions prior to 0.1.4, update to version 0.1.4 to resolve the issue. As a temporary workaround, consider restricting the input to the svg property to prevent untrusted data from being passed to the build(MessagePageOptions) function.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24718

GHSA-W6CX-QG2Q-RVQ8

Affected Products

Ssr-Pages

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24718.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24718 · Security Note
• https://github.com/Finastra/ssr-pages/pull/1 · Patch
• https://osv.dev/vulnerability/CVE-2022-24718 · Vendor Advisory
• https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780 · Patch
• https://github.com/Finastra/ssr-pages/security/advisories/GHSA-w6cx-qg2q-rvq8 · Patch
• https://osv.dev/vulnerability/GHSA-w6cx-qg2q-rvq8 · Vendor Advisory
• https://github.com/Finastra/ssr-pages · Note
• https://t.me/cibsecurity/38277 · Telegram Post
• https://t.me/cvenotify/27968 · Telegram Post