CVE-2022-21169

2022-09-2605:15:10

CWE-1321

[email protected]

web.nvd.nist.gov

cve-2022-21169

prototype pollution

allowedtags attribute

xss sanitization bypass

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

45.1%

JSON

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

Affected configurations

Nvd

Node

express_xss_sanitizer_projectexpress_xss_sanitizerRange<1.1.3node.js

VendorProductVersionCPE
express_xss_sanitizer_projectexpress_xss_sanitizer*cpe:2.3:a:express_xss_sanitizer_project:express_xss_sanitizer:*:*:*:*:*:node.js:*:*