CVE-2022-21824
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.5%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS
- 21.51% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-471, CWE-1321
- Affected
- nodejs/node.js · oracle/mysql cluster · oracle/mysql connectors · oracle/mysql enterprise monitor · oracle/mysql server · oracle/mysql workbench · oracle/peoplesoft enterprise peopletools · debian/debian linux · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/snapcenter
- Source
- support@hackerone.com
References
- https://hackerone.com/reports/1431042Issue Tracking, Mitigation, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlMailing List, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://hackerone.com/reports/1431042Issue Tracking, Mitigation, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlMailing List, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.