CVE-2023-23630 - Vulnerability Details - OpenCVE

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Eta.js	Eta

Configuration 1 [-]

cpe:2.3:a:eta.js:eta:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
https://github.com/eta-dev/eta/releases/tag/v2.0.0
https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6

History

Mon, 10 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-02-01T00:38:29.697Z

Updated: 2025-03-10T21:17:25.860Z

Reserved: 2023-01-16T17:07:46.245Z

Link: CVE-2023-23630

Vulnrichment

Updated: 2024-08-02T10:35:33.606Z

NVD

Status : Modified

Published: 2023-02-01T01:15:08.937

Modified: 2024-11-21T07:46:34.330

Link: CVE-2023-23630

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23630", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-01-16T17:07:46.245Z", "datePublished": "2023-02-01T00:38:29.697Z", "dateUpdated": "2025-03-10T21:17:25.860Z"}, "containers": {"cna": {"title": "Cross-site (XSS) vulnerability with Express API in Eta", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}], "affected": [{"vendor": "eta-dev", "product": "eta", "versions": [{"version": "< 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-01T00:38:29.697Z"}, "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "source": {"advisory": "GHSA-xrh7-m5pp-39r6", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.606Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T20:59:19.594118Z", "id": "CVE-2023-23630", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:17:25.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.606Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T20:59:19.594118Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T20:59:20.944Z"}}], "cna": {"title": "Cross-site (XSS) vulnerability with Express API in Eta", "source": {"advisory": "GHSA-xrh7-m5pp-39r6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "eta-dev", "product": "eta", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "references": [{"url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-01T00:38:29.697Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23630", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:17:25.860Z", "dateReserved": "2023-01-16T17:07:46.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-02-01T00:38:29.697Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eta.js:eta:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1E6958D1-1731-4523-BE7B-F4BBED80549B", "versionEndExcluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "id": "CVE-2023-23630", "lastModified": "2024-11-21T07:46:34.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-01T01:15:08.937", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}