** DISPUTED ** A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
08 Nov 2022, 22:15
Type | Values Removed | Values Added |
---|---|---|
Summary | ** DISPUTED ** A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid." |
27 Oct 2022, 14:48
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta1:*:*:*:node.js:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html - Third Party Advisory | |
References | (MISC) https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj - Third Party Advisory |
18 Oct 2022, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Oct 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-10-11 05:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-37616
Mitre link : CVE-2022-37616
CVE.ORG link : CVE-2022-37616
JSON object : View
Products Affected
xmldom_project
- xmldom
debian
- debian_linux
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')