PT-2023-20335 · Vm2+1 · Vm2+1

Published 2023-05-08 · Updated 2023-05-12 · CVE-2023-2583

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsreport versions prior to 3.11.3

Description The issue is related to code injection in the jsreport GitHub repository. An attacker can exploit this to obtain authority over the jsreport playground server or construct a malicious webpage/html file to attack the installed jsreport client. The vulnerability is due to a version of vm2 that is vulnerable to code injection being hardcoded in the package.json of the jsreport-core component.

Recommendations For versions prior to 3.11.3, update to version 3.11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the jsreport playground server and avoiding the use of the vulnerable vm2 version until a patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-2583

GHSA-G7RJ-Q722-245G

Affected Products

Jsreport

Vm2

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2583.json · Exploit
• 🔥 https://huntr.dev/bounties/397ea68d-1e28-44ff-b830-c8883d067d96 · Exploit
• https://github.com/jsreport/jsreport/commit/afaff3804b34b38e959f5ae65f9e672088de13d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2583 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2583 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7rj-q722-245g · Vendor Advisory
• https://github.com/jsreport/jsreport/releases/tag/3.11.3 · Note
• https://github.com/jsreport/jsreport · Note
• https://t.me/cvenotify/49952 · Telegram Post
• https://t.me/cibsecurity/63450 · Telegram Post