CVE-2022-25948 Information Exposure

2022-12-2200:00:00

snyk

www.cve.org

cve-2022-25948

information exposure

liquidjs

ownpropertyonly parameter

version 10.0.0

workaround

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

47.8%

JSON

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "liquidjs",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "10.0.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]