CVE-2022-25878

Katalog CVE

CVSS 7.5 · High EPSS 2,3%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada protobufjs project protobufjs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

Rincian

Terbit di NVD

27 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f patch · advisory pihak ketiga
• https://github.com/protobufjs/protobuf.js/pull/1731 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507 exploit · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248 exploit · patch · advisory pihak ketiga
• https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L19... broken link