CVE-2022-39357

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada wintercms winter. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

Rincian

Terbit di NVD

26 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 patch · advisory pihak ketiga
• https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f patch · advisory pihak ketiga
• https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q patch · advisory pihak ketiga
• https://github.com/wintercms/winter/releases/tag/v1.1.10 release notes · advisory pihak ketiga
• https://github.com/wintercms/winter/releases/tag/v1.2.1 release notes · advisory pihak ketiga