CVE-2022-37616

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada xmldom project xmldom, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."

Rincian

Terbit di NVD

11 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1 patch · advisory pihak ketiga
• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3 patch · advisory pihak ketiga
• https://github.com/xmldom/xmldom/issues/436 issue tracking · patch · advisory pihak ketiga
• http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf deskripsi teknis · advisory pihak ketiga
• https://dl.acm.org/doi/abs/10.1145/3488932.3497769 deskripsi teknis · advisory pihak ketiga
• https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 advisory pihak ketiga
• https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 issue tracking · advisory pihak ketiga
• https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560 issue tracking · advisory pihak ketiga
• https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html mailing list · advisory pihak ketiga