CVE-2022-44789

2022-11-2321:15:11

CWE-787

[email protected]

web.nvd.nist.gov

logical issue

artifex mujs

remote code execution

memory corruption

crafted javascript file

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.015

Percentile

87.2%

JSON

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.

Affected configurations

Nvd

Node

artifexmujsRange1.0.0–1.3.2

Node

debiandebian_linuxMatch11.0

Node

fedoraprojectfedoraMatch37

VendorProductVersionCPE
artifexmujs*cpe:2.3:a:artifex:mujs:*:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
artifex	mujs	*	cpe:2.3:a:artifex:mujs::::::::
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*