CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
69.2%
A prototype pollution vulnerability exists in the function copy in dom.js
in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for
Node.js via the p variable. NOTE: the vendor states “we are in the process
of marking this report as invalid”; however, some third parties takes the
position that “A prototype injection/Prototype pollution is not just when
global objects are polluted with recursive merge or deep cloning but also
when a target object is polluted.”
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | node-xmldom | < 0.1.27+ds-1+deb10u2build0.20.04.1 | UNKNOWN |
ubuntu | 22.04 | noarch | node-xmldom | < 0.7.5-1ubuntu0.22.04.1 | UNKNOWN |
ubuntu | 22.10 | noarch | node-xmldom | < 0.7.5-1ubuntu0.22.10.1 | UNKNOWN |
github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
github.com/xmldom/xmldom/pull/437
github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
launchpad.net/bugs/cve/CVE-2022-37616
nvd.nist.gov/vuln/detail/CVE-2022-37616
security-tracker.debian.org/tracker/CVE-2022-37616
ubuntu.com/security/notices/USN-6102-1
www.cve.org/CVERecord?id=CVE-2022-37616