CVE-2022-25906

2023-02-0105:15:11

CWE-78

[email protected]

web.nvd.nist.gov

cve

2022

25906

command injection

is-http2

nvd

vulnerability

security

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.8%

JSON

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

Affected configurations

NVD

Node

is-http2_projectis-http2Match-node.js

CPENameOperatorVersion
is-http2_project:is-http2is-http2 project is-http2eq-

CPE	Name	Operator	Version
is-http2_project:is-http2	is-http2 project is-http2	eq	-

CNA Affected

[
  {
    "product": "is-http2",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]