The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template     injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and     overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template     compilation). (CVE-2022-29078)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template
    injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and
    overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template
    compilation). (CVE-2022-29078)

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template     injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and     overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template     compilation). (CVE-2022-29078)

  - The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address     string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control     that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
    (CVE-2021-29418)

  - Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated     remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A     remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical     VPN or LAN hosts. (CVE-2021-28918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
224630	Linux Distros Unpatched Vulnerability : CVE-2022-29078	Nessus	Misc.	Local	critical
417547	SCA: security update for ejs (GHSA-phwq-j96m-2c2q)	Tenable Cloud Security	SCA Checks	Local	critical
417547	SCA: security update for ejs (GHSA-phwq-j96m-2c2q)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
164652	IBM Cognos Analytics Multiple Vulnerabilities (6616285)	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2022-29078

critical

Tenable Plugins

critical

critical

critical

critical