CVE-2022-24785 Path Traversal in Moment.js

2022-04-0400:00:00

CWE-22

CWE-27

GitHub_M

www.cve.org

javascript

date library

path traversal

vulnerability

npm

moment.js

locale string

patch

sanitize

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0.003

Percentile

71.1%

JSON

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CNA Affected

[
  {
    "vendor": "moment",
    "product": "moment",
    "versions": [
      {
        "version": ">= 1.0.1, < 2.29.2",
        "status": "affected"
      }
    ]
  }
]