CVE-2022-36067

🗓️ 06 Sep 2022 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 305 Views

vm2 sandbox bypass vulnerability in versions prior to 3.9.1

Reporter	Title	Published	Views	Family All 34
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2_Project Vm2	5 Nov 202213:28	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code execution due to [CVE-2022-36067]	3 Nov 202217:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
Circl	CVE-2022-36067	10 Oct 202212:21	–	circl
CNNVD	vm2 安全漏洞	6 Sep 202200:00	–	cnnvd
CNVD	VM2 Remote Code Execution Vulnerability	8 Sep 202200:00	–	cnvd
Cvelist	CVE-2022-36067 vm2 vulnerable to Sandbox Escape before v3.9.11	6 Sep 202200:00	–	cvelist
F5 Networks	K50343021: Node-vm2 vulnerability CVE-2022-36067	21 Feb 202318:34	–	f5

NVD

Vulners

Node

vm2_project vm2Range<3.9.11node.js

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "< 3.9.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js
github	www.github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
oxeye	www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067
security	www.security.netapp.com/advisory/ntap-20221017-0002/
github	www.github.com/patriksimek/vm2/issues/467

21 Nov 2024 07:12Current

10High risk

Vulners AI Score10

CVSS 3.110

EPSS0.84468

SSVC

CWE-913