CVE-2022-21824
Severity
8.2HIGH
EPSS
0.7%
top 28.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Latest updateApr 15
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype f…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HExploitability: 3.9 | Impact: 4.2
Affected Packages9 packages
Also affects: Debian Linux 10.0, 11.0
Patches
🔴Vulnerability Details
3📋Vendor Advisories
6Oracle▶
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud Manager (Node.js) — CVE-2022-21824↗2023-04-15
Microsoft▶
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with↗2022-02-08