CVE-2024-37301CWE-1336

document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

High · published June 11, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01040 · 63.7th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2024-06-11T18:34Z
EPSS history
Timeline
  • 11 JUN 18:34Z
    document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
    cvelistv5