CVE-2022-37616 — Prototype Pollution in Project Xmldom
Severity
9.8CRITICALNVD
OSV4.3
EPSS
1.2%
top 20.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 11
Latest updateMay 24
Description
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages8 packages
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
4📋Vendor Advisories
3Microsoft▶
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we a↗2022-10-11
Debian▶
CVE-2022-37616: node-xmldom - A prototype pollution vulnerability exists in the function copy in dom.js in the...↗2022