CVE-2022-44789

2022-11-2321:15:11

CWE-787

mitre

web.nvd.nist.gov

cve-2022-44789

artifex mujs

remote code execution

memory corruption

javascript

security vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.015

Percentile

87.2%

JSON

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Affected configurations

Nvd

Node

artifexmujsRange1.0.0–1.3.2

Node

debiandebian_linuxMatch11.0

Node

fedoraprojectfedoraMatch37

VendorProductVersionCPE
artifexmujs*cpe:2.3:a:artifex:mujs:*:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
artifex	mujs	*	cpe:2.3:a:artifex:mujs::::::::
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*