Lucene search

Prototype Pollution in convict

🗓️ 14 May 2022 00:09:01Reported by GitHub Advisory DatabaseType

Prototype Pollution bypass affecting convict package before version 6.2.

Reporter	Title	Published	Views	Family All 18
RedhatCVE	CVE-2022-21190	16 May 202204:26	–	redhatcve
RedhatCVE	CVE-2022-22143	2 May 202207:37	–	redhatcve
CVE	CVE-2022-21190	13 May 202220:15	–	cve
CVE	CVE-2022-22143	1 May 202216:15	–	cve
OSV	Prototype Pollution in convict	14 May 202200:01	–	osv
OSV	CVE-2022-21190	13 May 202220:15	–	osv
OSV	Prototype Pollution in convict	20 Apr 202216:21	–	osv
OSV	CVE-2022-22143	1 May 202216:15	–	osv
NVD	CVE-2022-21190	13 May 202220:15	–	nvd
NVD	CVE-2022-22143	1 May 202216:15	–	nvd

Vulners

Node

-convictRange<6.2.3

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-21190
github	www.github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
gist	www.gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
github	www.github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
github	www.github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07
snyk	www.snyk.io/vuln/SNYK-JS-CONVICT-2774757
github	www.github.com/advisories/GHSA-jjf5-wx3j-3fv7

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

14 May 2022 00:01Current

2.9Low risk

Vulners AI Score2.9

CVSS27.5

CVSS39.8

EPSS0.014

CWE-1321