vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host

🗓️ 28 Sep 2022 13:09:01Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 176 Views

vm2 Sandbox Escape Vulnerability Patche

Reporter	Title	Published	Views	Family All 35
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2_Project Vm2	5 Nov 202213:28	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code execution due to [CVE-2022-36067]	3 Nov 202217:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
BDU FSTEC	The vulnerability of the NPM package manager vm2 library allows a hacker to execute arbitrary code.	8 Sep 202200:00	–	bdu_fstec
Circl	CVE-2022-36067	10 Oct 202212:21	–	circl
CNNVD	vm2 安全漏洞	6 Sep 202200:00	–	cnnvd
CNVD	VM2 Remote Code Execution Vulnerability	8 Sep 202200:00	–	cnvd
CVE	CVE-2022-36067	6 Sep 202200:00	–	cve

Vulners

Node

vm2_project vm2Range<3.9.11npm

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-36067
github	www.github.com/patriksimek/vm2/issues/467
github	www.github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873
github	www.github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js
oxeye	www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067
security	www.security.netapp.com/advisory/ntap-20221017-0002/
github	www.github.com/advisories/GHSA-mrgp-mrhc-5jrq

30 Jan 2023 05:07Current

9.7High risk

Vulners AI Score9.7

CVSS 3.110

EPSS0.47868

SSVC