Description

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:

Remediation

References

https://snyk.io/vuln/SNYK-JS-CORENLPJSPREFAB-1050434

Related Vulnerabilities

CVE-2017-16149 Vulnerability in npm package zwserver

CVE-2017-16195 Vulnerability in npm package pytservce

CVE-2022-28220 Vulnerability in maven package org.apache.james:james-server-protocols-imap4

CVE-2019-17495 Vulnerability in npm package swagger-ui

CVE-2019-6284 Vulnerability in npm package node-sass

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory