Lucene search

GoogleOSV:CVE-2022-25907

HistoryAug 09, 2022 - 5:15 a.m.

CVE-2022-25907

2022-08-0905:15:07

Google

osv.dev

package vulnerability

prototype pollution

missing sanitization

ts-deepmerge

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.3%

JSON

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.

CPENameOperatorVersion
ts-deepmergeeq1.0.4
ts-deepmergeeq1.0.0
ts-deepmergeeq1.0.7
ts-deepmergeeq1.0.3
ts-deepmergeeq1.0.2
ts-deepmergeeq1.0.5
ts-deepmergeeq1.0.6
ts-deepmergeeq1.1.0
ts-deepmergeeq2.0.0
ts-deepmergeeq1.0.1

Name	Operator	Version
ts-deepmerge	eq	1.0.4
ts-deepmerge	eq	1.0.0
ts-deepmerge	eq	1.0.7
ts-deepmerge	eq	1.0.3
ts-deepmerge	eq	1.0.2
ts-deepmerge	eq	1.0.5
ts-deepmerge	eq	1.0.6
ts-deepmerge	eq	1.1.0
ts-deepmerge	eq	2.0.0
ts-deepmerge	eq	1.0.1

Rows per page:

1-10 of 121

References

github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10b

github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2

security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.3%

JSON

Related for OSV:CVE-2022-25907