This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123)
References
| Link | Resource |
|---|---|
| https://github.com/monsterkodi/sds/blob/master/js/set.js | Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-SDS-2385944 | Exploit Third Party Advisory |
| https://github.com/monsterkodi/sds/blob/master/js/set.js | Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-SDS-2385944 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 06:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/monsterkodi/sds/blob/master/js/set.js - Third Party Advisory | |
| References | () https://snyk.io/vuln/SNYK-JS-SDS-2385944 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 4.0 |
24 May 2022, 15:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sds_project:sds:*:*:*:*:*:node.js:*:* | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-JS-SDS-2385944 - Exploit, Third Party Advisory | |
| References | (CONFIRM) https://github.com/monsterkodi/sds/blob/master/js/set.js - Third Party Advisory | |
| CWE | CWE-1321 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
13 May 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-13 20:15
Updated : 2024-11-21 06:53
NVD link : CVE-2022-25862
Mitre link : CVE-2022-25862
CVE.ORG link : CVE-2022-25862
JSON object : View
Products Affected
sds_project
- sds
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')