CVE-2024-37301

Published: Jun 11, 2024Modified: Jun 17, 2026Deferred

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.

Related CWEs

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

References (4)

https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074

Source: security-advisories@github.com

https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6

Source: security-advisories@github.com

https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.