Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-21824

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Published

2022-02-24T19:15:10.080

Last Modified

2024-11-21T06:45:30.450

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.2 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-471
  • Type: Primary
    CWE-1321
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js < 12.22.9 Yes
Application nodejs node.js < 14.18.3 Yes
Application nodejs node.js < 16.13.2 Yes
Application nodejs node.js < 17.3.1 Yes
Application oracle mysql_cluster ≤ 8.0.29 Yes
Application oracle mysql_connectors ≤ 8.0.28 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.29 Yes
Application oracle mysql_server ≤ 8.0.29 Yes
Application oracle mysql_workbench ≤ 8.0.28 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
Application netapp oncommand_insight - Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp snapcenter - Yes
References