Vulnerability-Lookup

RHSA-2023:0050

Vulnerability from csaf_opensuse - Published: 2023-01-09 00:00 - Updated: 2026-09-20 11:25

Summary

security update for nodejs

Severity

Moderate

Notes

Title of the patch: security update for nodejs

Description of the patch: This security update provides a functional equivalent of RHSA-2023:0050. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2023:0050.

Patchnames: RHSA-2023:0050

CVE-2021-44906

5.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 7 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14	—	Vendor Fix

Threats

Impact moderate

CVE-2022-0235

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

Recommended 7 products, the same list as for CVE-2021-44906

Threats

Impact moderate

CVE-2022-24999

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 7 products, the same list as for CVE-2021-44906

Threats

Impact important

CVE-2022-3517

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 7 products, the same list as for CVE-2021-44906

Threats

Impact important

CVE-2022-43548

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 7 products, the same list as for CVE-2021-44906

Threats

Impact important

References

15 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2021-44906/	self
https://www.suse.com/security/cve/CVE-2022-0235/	self
https://www.suse.com/security/cve/CVE-2022-24999/	self
https://www.suse.com/security/cve/CVE-2022-3517/	self
https://www.suse.com/security/cve/CVE-2022-43548/	self
https://www.suse.com/security/cve/CVE-2021-44906	external
https://bugzilla.suse.com/1198247	external
https://www.suse.com/security/cve/CVE-2022-0235	external
https://bugzilla.suse.com/1194819	external
https://www.suse.com/security/cve/CVE-2022-24999	external
https://www.suse.com/security/cve/CVE-2022-3517	external
https://www.suse.com/security/cve/CVE-2022-43548	external
https://bugzilla.suse.com/1205119	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for nodejs",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2023:0050.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2023:0050.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2023:0050",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_0050.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-44906 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-44906/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-0235 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-0235/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-24999 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-24999/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-3517 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-3517/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2022-43548 page",
        "url": "https://www.suse.com/security/cve/CVE-2022-43548/"
      }
    ],
    "title": "security update for nodejs",
    "tracking": {
      "current_release_date": "2026-09-20T11:25:33Z",
      "generator": {
        "date": "2023-01-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2023:0050",
      "initial_release_date": "2023-01-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-01-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:25:33Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
                "product": {
                  "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch (nodejs:14)",
                  "product_id": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-docs@14.21.1-2.module+el8.7.0+17528+a329cd47?arch=noarch\u0026rpmmod=nodejs:14:8000020230109212039:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
                "product": {
                  "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch (nodejs:14)",
                  "product_id": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-nodemon@2.0.20-2.module+el8.7.0+17528+a329cd47?arch=noarch\u0026rpmmod=nodejs:14:8000020230109212039:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
                "product": {
                  "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch (nodejs:14)",
                  "product_id": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-packaging@23-3.module+el8.3.0+6519+9f98ed83?arch=noarch\u0026rpmmod=nodejs:14:8000020221121160839:rhel8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                "product": {
                  "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 (nodejs:14)",
                  "product_id": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:nodejs:node.js:14.21.1:*:*:*:-:*:*:*",
                    "purl": "pkg:rpm/suse/nodejs@14.21.1-2.module+el8.7.0+17528+a329cd47?arch=x86_64\u0026rpmmod=nodejs:14:8000020230109212039:rhel8\u0026epoch=1\u0026upstream=nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                "product": {
                  "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 (nodejs:14)",
                  "product_id": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-devel@14.21.1-2.module+el8.7.0+17528+a329cd47?arch=x86_64\u0026rpmmod=nodejs:14:8000020230109212039:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                "product": {
                  "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64 (nodejs:14)",
                  "product_id": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-full-i18n@14.21.1-2.module+el8.7.0+17528+a329cd47?arch=x86_64\u0026rpmmod=nodejs:14:8000020230109212039:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                "product": {
                  "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64 (nodejs:14)",
                  "product_id": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/npm@6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47?arch=x86_64\u0026rpmmod=nodejs:14:8000020230109212039:rhel8\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        },
        "product_reference": "nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        },
        "product_reference": "nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14"
        },
        "product_reference": "nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        },
        "product_reference": "nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14"
        },
        "product_reference": "nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14"
        },
        "product_reference": "nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        },
        "product_reference": "npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44906",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-44906"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Minimist \u003c=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
          "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-44906",
          "url": "https://www.suse.com/security/cve/CVE-2021-44906"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1198247 for CVE-2021-44906",
          "url": "https://bugzilla.suse.com/1198247"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-01-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-44906"
    },
    {
      "cve": "CVE-2022-0235",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-0235"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
          "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-0235",
          "url": "https://www.suse.com/security/cve/CVE-2022-0235"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1194819 for CVE-2022-0235",
          "url": "https://bugzilla.suse.com/1194819"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-01-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2022-0235"
    },
    {
      "cve": "CVE-2022-24999",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-24999"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
          "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-24999",
          "url": "https://www.suse.com/security/cve/CVE-2022-24999"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-01-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-24999"
    },
    {
      "cve": "CVE-2022-3517",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-3517"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
          "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-3517",
          "url": "https://www.suse.com/security/cve/CVE-2022-3517"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-01-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-3517"
    },
    {
      "cve": "CVE-2022-43548",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2022-43548"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
          "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
          "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2022-43548",
          "url": "https://www.suse.com/security/cve/CVE-2022-43548"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1205119 for CVE-2022-43548",
          "url": "https://bugzilla.suse.com/1205119"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-devel-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-docs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:14.21.1-2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17528+a329cd47.noarch::nodejs:14",
            "SUSE Liberty Linux 8:nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch::nodejs:14",
            "SUSE Liberty Linux 8:npm-1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47.x86_64::nodejs:14"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-01-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2022-43548"
    }
  ]
}

CVE-2021-44906 (GCVE-0-2021-44906)

Vulnerability from cvelistv5 – Published: 2022-03-17 13:05 – Updated: 2024-08-04 04:32

Summary

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
https://github.com/Marynk/JavaScript-vulnerabilit…
https://github.com/substack/minimist/blob/master/…
https://stackoverflow.com/questions/8588563/addin…
https://github.com/substack/minimist/issues/164
https://security.netapp.com/advisory/ntap-2024062…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:32:13.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/substack/minimist/blob/master/index.js#L69"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/substack/minimist/issues/164"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Minimist \u003c=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:14.002Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"
        },
        {
          "url": "https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip"
        },
        {
          "url": "https://github.com/substack/minimist/blob/master/index.js#L69"
        },
        {
          "url": "https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"
        },
        {
          "url": "https://github.com/substack/minimist/issues/164"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-44906",
    "datePublished": "2022-03-17T13:05:57.000Z",
    "dateReserved": "2021-12-13T00:00:00.000Z",
    "dateUpdated": "2024-08-04T04:32:13.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-0235 (GCVE-0-2022-0235)

Vulnerability from cvelistv5 – Published: 2022-01-16 00:00 – Updated: 2024-08-02 23:18

Title

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

Summary

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

@huntrdev

References

4 references

URL	Tags
https://huntr.dev/bounties/d26ab655-38d6-48b3-be1…
https://github.com/node-fetch/node-fetch/commit/3…
https://cert-portal.siemens.com/productcert/pdf/s…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
node-fetch	node-fetch/node-fetch	Affected: unspecified , < 3.1.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:18:42.930Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
          },
          {
            "name": "[debian-lts-announce] 20221205 [SECURITY] [DLA 3222-1] node-fetch security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-fetch/node-fetch",
          "vendor": "node-fetch",
          "versions": [
            {
              "lessThan": "3.1.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-05T00:00:00.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "url": "https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7"
        },
        {
          "url": "https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"
        },
        {
          "name": "[debian-lts-announce] 20221205 [SECURITY] [DLA 3222-1] node-fetch security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html"
        }
      ],
      "source": {
        "advisory": "d26ab655-38d6-48b3-be15-f9ad6b6ae6f7",
        "discovery": "EXTERNAL"
      },
      "title": "Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0235",
    "datePublished": "2022-01-16T00:00:00.000Z",
    "dateReserved": "2022-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:18:42.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24999 (GCVE-0-2022-24999)

Vulnerability from cvelistv5 – Published: 2022-11-26 00:00 – Updated: 2025-04-29 13:56

Summary

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-29 13:56 UTC

CWE

n/a
CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

mitre mitre root

References

5 references

URL	Tags
https://github.com/expressjs/express/releases/tag…
https://github.com/ljharb/qs/pull/428
https://github.com/n8tz/CVE-2022-24999
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.netapp.com/advisory/ntap-2023090…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:29:01.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/expressjs/express/releases/tag/4.17.3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ljharb/qs/pull/428"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/n8tz/CVE-2022-24999"
          },
          {
            "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3299-1] node-qs security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230908-0005/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-24999",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T13:56:22.823843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1321",
                "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T13:56:42.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-08T16:06:42.462Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/expressjs/express/releases/tag/4.17.3"
        },
        {
          "url": "https://github.com/ljharb/qs/pull/428"
        },
        {
          "url": "https://github.com/n8tz/CVE-2022-24999"
        },
        {
          "name": "[debian-lts-announce] 20230130 [SECURITY] [DLA 3299-1] node-qs security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230908-0005/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-24999",
    "datePublished": "2022-11-26T00:00:00.000Z",
    "dateReserved": "2022-02-14T00:00:00.000Z",
    "dateUpdated": "2025-04-29T13:56:42.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3517 (GCVE-0-2022-3517)

Vulnerability from cvelistv5 – Published: 2022-10-17 00:00 – Updated: 2025-05-13 13:41

Summary

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-13 13:40 UTC

CWE

CWE-400

Assigner

redhat redhat root

References

5 references

URL	Tags
https://github.com/isaacs/minimatch/commit/a8763f…
https://github.com/grafana/grafana-image-renderer…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
n/a	minimatch	Affected: minimatch versions prior to 3.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:14:02.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/grafana/grafana-image-renderer/issues/329"
          },
          {
            "name": "[debian-lts-announce] 20230115 [SECURITY] [DLA 3271-1] node-minimatch security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html"
          },
          {
            "name": "FEDORA-2023-ce8943223c",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/"
          },
          {
            "name": "FEDORA-2023-18fd476362",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-13T13:40:25.643168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-13T13:41:10.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "minimatch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "minimatch versions prior to 3.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-21T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6"
        },
        {
          "url": "https://github.com/grafana/grafana-image-renderer/issues/329"
        },
        {
          "name": "[debian-lts-announce] 20230115 [SECURITY] [DLA 3271-1] node-minimatch security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html"
        },
        {
          "name": "FEDORA-2023-ce8943223c",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/"
        },
        {
          "name": "FEDORA-2023-18fd476362",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-3517",
    "datePublished": "2022-10-17T00:00:00.000Z",
    "dateReserved": "2022-10-14T00:00:00.000Z",
    "dateUpdated": "2025-05-13T13:41:10.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-43548 (GCVE-0-2022-43548)

Vulnerability from cvelistv5 – Published: 2022-12-05 00:00 – Updated: 2025-04-30 05:55

Summary

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-24 14:03 UTC

CWE

CWE-78 - OS Command Injection (CWE-78)

Assigner

hackerone mitre root

References

5 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/november…
https://security.netapp.com/advisory/ntap-2023012…
https://www.debian.org/security/2023/dsa-5326	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://security.netapp.com/advisory/ntap-2023042…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.21.1 (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.18.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.12.1 (semver) Affected: 19.0 , < 19.0.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:32:59.546Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230120-0004/"
          },
          {
            "name": "DSA-5326",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5326"
          },
          {
            "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0007/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-43548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T14:03:01.021194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-24T14:03:05.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.21.1",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.18.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.12.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.0.1",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection (CWE-78)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T05:55:04.408Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230120-0004/"
        },
        {
          "name": "DSA-5326",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5326"
        },
        {
          "name": "[debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0007/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2022-43548",
    "datePublished": "2022-12-05T00:00:00.000Z",
    "dateReserved": "2022-10-20T00:00:00.000Z",
    "dateUpdated": "2025-04-30T05:55:04.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023:0050

CVE-2021-44906 (GCVE-0-2021-44906)

CVE-2022-0235 (GCVE-0-2022-0235)

CVE-2022-24999 (GCVE-0-2022-24999)

CVE-2022-3517 (GCVE-0-2022-3517)

CVE-2022-43548 (GCVE-0-2022-43548)

Tags

Sightings

Nomenclature

Related by attack behaviour