CVE-2022-23623

Katalog CVE

CVSS 8.8 · High EPSS 1,2%

Kerentanan Improper Input Validation pada frourio. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.

Rincian

Terbit di NVD

7 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/frouriojs/frourio/commit/7c19ac5363305b81b1c6b5232620228763d427af patch · advisory pihak ketiga
• https://github.com/frouriojs/frourio/security/advisories/GHSA-8xxm-h73r-ghfj advisory pihak ketiga