CVE-2022-37616
published 2022-10-11CVE-2022-37616: A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.12%
81.7th percentile
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-xmldom | < node-xmldom 0.8.3-1 (bookworm) | node-xmldom 0.8.3-1 (bookworm) |
| msrc | azl3_python-tensorboard_2.11.0-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-tensorboard_2.16.2-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| xmldom | xmldom | >= 0 < 0.7.6 | 0.7.6 |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.8.0 < 0.8.3 | 0.8.3 |
| xmldom | xmldom | >= 0.9.0-beta.1 < 0.9.0-beta.2 | 0.9.0-beta.2 |
| xmldom_project | xmldom | <= 0.6.0 | — |
| xmldom_project | xmldom | — | — |
| xmldom_project | xmldom | >= 0.7.0 < 0.7.6 | 0.7.6 |
| xmldom_project | xmldom | >= 0.8.0 < 0.8.3 | 0.8.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
node-xmldom vulnerabilities
osv·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] node-xmldom vulnerabilities
node-xmldom vulnerabilities
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
GHSA
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
ghsa·2022-10-11
CVE-2022-37616 [CRITICAL] CWE-1321 Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
## Withdrawn
This advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.
## Original Description
### Impact
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
### Patches
Update to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.2` (dist-tag `next`).
### Workarounds
None
### References
https://github.com/xmldom/xmldom/pull/437
### For more information
If you have any question
OSV
CVE-2022-37616: A prototype pollution vulnerability exists in the function copy in dom
osv·2022-10-11·CVSS 9.8
CVE-2022-37616 [CRITICAL] CVE-2022-37616: A prototype pollution vulnerability exists in the function copy in dom
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
OSV
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
osv·2022-10-11
CVE-2022-37616 [CRITICAL] Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
## Withdrawn
This advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.
## Original Description
### Impact
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
### Patches
Update to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.2` (dist-tag `next`).
### Workarounds
None
### References
https://github.com/xmldom/xmldom/pull/437
### For more information
If you have any question
Ubuntu
xmldom vulnerabilities
vendor_ubuntu·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] xmldom vulnerabilities
Title: xmldom vulnerabilities
Summary: Several security issues were fixed in xmldom.
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we a
vendor_msrc·2022-10-11·CVSS 9.8
CVE-2022-37616 [CRITICAL] CWE-1321 A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we a
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the op
Debian
CVE-2022-37616: node-xmldom - A prototype pollution vulnerability exists in the function copy in dom.js in the...
vendor_debian·2022·CVSS 9.8
CVE-2022-37616 [CRITICAL] CVE-2022-37616: node-xmldom - A prototype pollution vulnerability exists in the function copy in dom.js in the...
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Scope: local
bookworm: resolved (fixed in 0.8.3-1)
bullseye: resolved (fixed in 0.5.0-1+deb11u1)
forky: resolved (fixed in 0.8.3-1)
sid: resolved (fixed in 0.8.3-1)
trixie: resolved (fixed in 0.8.3-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdfhttps://dl.acm.org/doi/abs/10.1145/3488932.3497769https://dl.acm.org/doi/pdf/10.1145/3488932.3497769https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3https://github.com/xmldom/xmldom/issues/436https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqjhttps://lists.debian.org/debian-lts-announce/2022/10/msg00023.htmlhttp://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdfhttps://dl.acm.org/doi/abs/10.1145/3488932.3497769https://dl.acm.org/doi/pdf/10.1145/3488932.3497769https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3https://github.com/xmldom/xmldom/issues/436https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqjhttps://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
2022-10-11
Published