CVE-2023-23630 - Vulnerability Details - OpenCVE

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00229.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Eta.js	Eta

Configuration 1 [-]

cpe:2.3:a:eta.js:eta:*:*:*:*:*:node.js:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-0593	Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`.
Github GHSA	GHSA-xrh7-m5pp-39r6	XSS Attack with Express API

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
https://github.com/eta-dev/eta/releases/tag/v2.0.0
https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6

History

Mon, 10 Mar 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-02-01T00:38:29.697Z

Updated: 2025-03-10T21:17:25.860Z

Reserved: 2023-01-16T17:07:46.245Z

Link: CVE-2023-23630

Vulnrichment

Updated: 2024-08-02T10:35:33.606Z

NVD

Status : Modified

Published: 2023-02-01T01:15:08.937

Modified: 2024-11-21T07:46:34.330

Link: CVE-2023-23630

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23630", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-01-16T17:07:46.245Z", "datePublished": "2023-02-01T00:38:29.697Z", "dateUpdated": "2025-03-10T21:17:25.860Z"}, "containers": {"cna": {"title": "Cross-site (XSS) vulnerability with Express API in Eta", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}], "affected": [{"vendor": "eta-dev", "product": "eta", "versions": [{"version": "< 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-01T00:38:29.697Z"}, "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "source": {"advisory": "GHSA-xrh7-m5pp-39r6", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.606Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T20:59:19.594118Z", "id": "CVE-2023-23630", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:17:25.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.606Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T20:59:19.594118Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T20:59:20.944Z"}}], "cna": {"title": "Cross-site (XSS) vulnerability with Express API in Eta", "source": {"advisory": "GHSA-xrh7-m5pp-39r6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "eta-dev", "product": "eta", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "references": [{"url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "name": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "name": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "name": "https://github.com/eta-dev/eta/releases/tag/v2.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-02-01T00:38:29.697Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23630", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:17:25.860Z", "dateReserved": "2023-01-16T17:07:46.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-02-01T00:38:29.697Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eta.js:eta:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1E6958D1-1731-4523-BE7B-F4BBED80549B", "versionEndExcluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to `res.render`. \n"}], "id": "CVE-2023-23630", "lastModified": "2024-11-21T07:46:34.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-01T01:15:08.937", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/eta-dev/eta/releases/tag/v2.0.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}