swig-1.4.2.tgz: 2 vulnerabilities (highest severity is: 8.7) [master] (reachable)

[mend-developer-platform-dev]

📂 Vulnerable Library - swig-1.4.2.tgz

A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.

Path to dependency file: /package.json

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
CVE-2015-8858	🔴 High	8.7	Not Defined	< 1%	uglify-js-2.4.24.tgz	Transitive	N/A	❌	Unreachable
CVE-2023-25345	🔴 High	8.7	Not Defined	< 1%	swig-1.4.2.tgz	Direct	no_fix	✅	Reachable

Details

🔴CVE-2015-8858

Vulnerable Library - uglify-js-2.4.24.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.4.24.tgz

Path to dependency file: /package.json

Dependency Hierarchy:

• swig-1.4.2.tgz (Root Library)
  • ❌ uglify-js-2.4.24.tgz (Vulnerable Library)

---

Reachability Analysis

The vulnerable code is unreachable

---

Vulnerability Details

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Publish Date: Jan 23, 2017 09:00 PM

URL: CVE-2015-8858

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-c9f4-xj24-8jqx

Release Date: Jan 23, 2017 09:00 PM

Fix Resolution : uglify-js - 2.6.0

🔴CVE-2023-25345

Vulnerable Library - swig-1.4.2.tgz

A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.

Library home page: https://registry.npmjs.org/swig/-/swig-1.4.2.tgz

Path to dependency file: /package.json

Dependency Hierarchy:

• ❌ swig-1.4.2.tgz (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- owasp-nodejs-goat-1.3.0/server.js (Application)
    - swig-1.4.2/index.js (Extension)
        - swig-1.4.2/lib/swig.js (Extension)
            - swig-1.4.2/lib/loaders/index.js (Extension)
                -> ❌ swig-1.4.2/lib/loaders/filesystem.js (Vulnerable Component)

---

Vulnerability Details

Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.

Publish Date: Mar 15, 2023 12:00 AM

URL: CVE-2023-25345

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

---

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-25345

Release Date: Mar 15, 2023 12:00 AM

Fix Resolution : no_fix