swig-1.4.2.tgz: 2 vulnerabilities (highest severity is: 7.5) [main] #31
Description
📂 Vulnerable Library - swig-1.4.2.tgz
A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.
Path to dependency file: /package.json
Findings
| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2015-8858 | 🔴 High | 7.5 | Not Defined | < 1% | uglify-js-2.4.24.tgz | Transitive | N/A | ❌ | |
| CVE-2023-25345 | 🔴 High | 7.5 | Not Defined | < 1% | swig-1.4.2.tgz | Direct | no_fix | ✅ |
Details
🔴CVE-2015-8858
Vulnerable Library - uglify-js-2.4.24.tgz
JavaScript parser, mangler/compressor and beautifier toolkit
Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-2.4.24.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- swig-1.4.2.tgz (Root Library)
- ❌ uglify-js-2.4.24.tgz (Vulnerable Library)
Vulnerability Details
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
Publish Date: Jan 23, 2017 09:00 PM
URL: CVE-2015-8858
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 7.5
Suggested Fix
Type: Upgrade version
Origin: GHSA-c9f4-xj24-8jqx
Release Date: Jan 23, 2017 09:00 PM
Fix Resolution : uglify-js - 2.6.0
🔴CVE-2023-25345
Vulnerable Library - swig-1.4.2.tgz
A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.
Library home page: https://registry.npmjs.org/swig/-/swig-1.4.2.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ swig-1.4.2.tgz (Vulnerable Library)
Vulnerability Details
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
Publish Date: Mar 15, 2023 12:00 AM
URL: CVE-2023-25345
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 7.5
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-25345
Release Date: Mar 15, 2023 12:00 AM
Fix Resolution : no_fix