CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
69.2%
This advisory has been withdrawn because the maintainers of @xmldom/xmldom
and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
Update to @xmldom/xmldom@~0.7.6
, @xmldom/xmldom@~0.8.3
(dist-tag latest
) or @xmldom/xmldom@>=0.9.0-beta.2
(dist-tag next
).
None
https://github.com/xmldom/xmldom/pull/437
If you have any questions or comments about this advisory:
users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
dl.acm.org/doi/abs/10.1145/3488932.3497769
dl.acm.org/doi/pdf/10.1145/3488932.3497769
github.com/advisories/GHSA-9pgh-qqpf-7wqj
github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
github.com/xmldom/xmldom/blob/master/CHANGELOG.md#076
github.com/xmldom/xmldom/issues/436
github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
github.com/xmldom/xmldom/issues/436#issuecomment-1327776560
github.com/xmldom/xmldom/pull/437
github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
lists.debian.org/debian-lts-announce/2022/10/msg00023.html
nvd.nist.gov/vuln/detail/CVE-2022-37616