Lucene search

SnykCVE-2022-25760

HistoryMar 17, 2022 - 12:15 p.m.

CVE-2022-25760

2022-03-1712:15:08

CWE-94

snyk

web.nvd.nist.gov

cve-2022-25760

vulnerability

code injection

input sanitization

nvd

security

javascript

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.007

Percentile

80.0%

JSON

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package’s exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Affected configurations

Nvd

Node

accesslog_projectaccesslog

VendorProductVersionCPE
accesslog_projectaccesslog*cpe:2.3:a:accesslog_project:accesslog:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
accesslog_project	accesslog	*	cpe:2.3:a:accesslog_project:accesslog::::::::

CNA Affected

[
  {
    "product": "accesslog",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/carlos8f/node-accesslog/blob/master/lib/compile.js%23L6

snyk.io/vuln/SNYK-JS-ACCESSLOG-2312099

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.007

Percentile

80.0%

JSON

Related for CVE-2022-25760