Description
This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:
Remediation
References
https://github.com/skoranga/node-connection-tester/pull/10
https://snyk.io/vuln/SNYK-JS-CONNECTIONTESTER-1048337
Related Vulnerabilities
CVE-2023-41900 Vulnerability in maven package org.eclipse.jetty:jetty-openid
CVE-2011-2487 Vulnerability in maven package org.apache.ws.security:wss4j
CVE-2020-16040 Vulnerability in maven package org.webjars.npm:electron
CVE-2018-14041 Vulnerability in maven package org.webjars.bower:bootstrap
CVE-2022-24823 Vulnerability in maven package io.netty:netty-common