CVE-2022-24785

Katalog CVE

CVSS 7.5 · High EPSS 13,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada momentjs moment, tenable.sc +3 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Rincian

Terbit di NVD

4 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-27: Path Traversal: 'dir/../../filename'

EPSS (30 hari)

13,9% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4 advisory vendor
• https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 patch
• https://www.tenable.com/security/tns-2022-09 patch · release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220513-0006/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIH...
• https://security.netapp.com/advisory/ntap-20241108-0002/