Lucene search
PRIOn knowledge basePRION:CVE-2022-36067HistorySep 06, 2022 - 10:15 p.m.
Remote code execution
2022-09-0622:15:00
PRIOn knowledge base
www.prio-n.com
2
remote code execution
vm2 sandbox
threat actor
vulnerability patch
nvd
vm2 is a sandbox that can run untrusted code with whitelisted Node’s built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
References
github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js
github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873
github.com/patriksimek/vm2/issues/467
github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
security.netapp.com/advisory/ntap-20221017-0002/
www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067
Related
cnvd
cnvd
VM2 Remote Code Execution Vulnerability
2022-09-08 00:00:00
ibm
ibm
Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs
2022-12-15 03:09:07
cve
cve
CVE-2022-36067
2022-09-06 22:15:09
githubexploit
githubexploit
cvelist
cvelist
CVE-2022-36067 vm2 vulnerable to Sandbox Escape before v3.9.11
2022-09-06 00:00:00
redhat
redhat
f5
f5
K50343021 : Node-vm2 vulnerability CVE-2022-36067
2022-12-08 00:00:00
osv
osv
vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host
2022-09-28 13:09:01
CVE-2022-36067
2022-09-06 22:15:09
nvd
nvd
CVE-2022-36067
2022-09-06 22:15:09
redhatcve
redhatcve
CVE-2022-36067
2022-09-07 09:30:28
thn
thn
nessus
nessus
Node.js Module vm2 < 3.9.11 Sandbox Breakout
2023-03-30 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2022-09-07 04:57:16
github
github
vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host
2022-09-28 13:09:01
openvas
openvas
vm2 < 3.9.11 Sandbox Escape Vulnerability
2023-05-02 00:00:00