CVE-2024-33883: Medium severity IBM Data Virtualization on Cloud Pak for Data vulnerability
Node.js ejs(Embedded JavaScript templates) module is vulnerable to a denial of service, caused by the lack of certain pollution protection. A local attacker could exploit this vulnerability to cause a denial of service.
Other sources
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ejsto a version that resolves this vulnerability.Fixed in 3.1.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33883?
CVE-2024-33883 has a high severity as it exposes applications to denial of service attacks.
How do I fix CVE-2024-33883?
To fix CVE-2024-33883, update the ejs package to version 3.1.10 or later.
Which versions of ejs are affected by CVE-2024-33883?
CVE-2024-33883 affects ejs versions prior to 3.1.10.
Can CVE-2024-33883 be exploited remotely?
No, CVE-2024-33883 requires local access to exploit the vulnerability.
Is there a specific software that is vulnerable to CVE-2024-33883?
Yes, IBM Analytics Content Hub versions up to and including 2.0 are vulnerable to CVE-2024-33883.