CVE-2024-37301 document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

2024-06-1118:34:38

CWE-1336

GitHub_M

www.cve.org

remote code execution

server-side template injection

vulnerable version

full takeover

patched version

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.

CNA Affected

[
  {
    "vendor": "adfinis",
    "product": "document-merge-service",
    "versions": [
      {
        "version": "< 6.5.2",
        "status": "affected"
      }
    ]
  }
]