CVE-2022-24785

CWE-22 — Path TraversalCWE-2713 documents9 sources
Severity
7.5HIGH
EPSS
2.3%
top 15.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Momentjs MomentTenable Tenable.scMoment Moment+2 more
Timeline
PublishedApr 4
Latest updateOct 15

Description

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶npmmoment< 2.29.2
▶NuGetMoment.js< 2.29.2
▶NVDmomentjs/moment1.0.1 — 2.29.2
▶Debiannode-moment< 2.29.1+ds-2+deb11u1+3
▶Ubuntunode-moment< 2.20.1+ds-1ubuntu0.1+2

Also affects: Debian Linux 10.0, Fedora 35, 36

Patches

Patch: github.com ↗Patch: www.tenable.com ↗Patch: github.com ↗

🔴Vulnerability Details

8
OSV
node-moment vulnerabilities↗2022-08-10
▶
GHSA
Ghost vulnerable to remote code execution in locale setting change↗2022-06-17
▶
OSV
Ghost vulnerable to remote code execution in locale setting change↗2022-06-17
▶
OSV
Path Traversal: 'dir/../../filename' in moment.locale↗2022-04-04
▶
CVEList
Path Traversal in Moment.js↗2022-04-04
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Moment.js) — CVE-2022-24785↗2022-10-15
▶
Ubuntu
Moment.js vulnerabilities↗2022-08-10
▶
Red Hat
Moment.js: Path traversal in moment.locale↗2022-04-04
▶
Debian
CVE-2022-24785: node-moment - Moment.js is a JavaScript date library for parsing, validating, manipulating, an...↗2022
▶