CVE-2022-21824

Katalog CVE

CVSS 8.2 · High EPSS 21,5%

Kerentanan Modification of Assumed-Immutable Data (MAID) pada nodejs node.js, oracle mysql cluster +9 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Rincian

Terbit di NVD

24 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-471: Modification of Assumed-Immutable Data (MAID)
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

21,5% peluang dieksploitasi; lebih tinggi dari 97,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ release notes · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://hackerone.com/reports/1431042 issue tracking · mitigasi · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220325-0007/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220729-0004/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5170 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga