Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE–2022–37601 #1

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Jan 31, 2024

CVE–2022–37601

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

GitHub

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

GitLab Advisory Database (Open Source Edition)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
References

    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    loader-utils/lib/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    npm/loader-utils/CVE-2022-37601.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    NVD - CVE-2022-37601
    Prototype pollution in webpack loader-utils · CVE-2022-37601 · GitHub Advisory Database · GitHub
    loader-utils/lib/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    Release v2.0.3 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    Release v1.4.1 · webpack/loader-utils · GitHub
    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    THIRD PARTY
    On Measuring Vulnerable JavaScript Functions in the Wild | Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security
    [invalid] Prototype pollution found in dom.js · Issue #436 · xmldom/xmldom · GitHub
    On Measuring Vulnerable JavaScript Functions in the Wild | Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security
    [SECURITY] [DLA 3258-1] node-loader-utils security update
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit · webpack/loader-utils@f4e48a2 · GitHub
    fix: security problem (#220) · webpack/loader-utils@4504e34 · GitHub
    fix(security): prototype polution exploit (#217) · webpack/loader-utils@a93cf6f · GitHub
    Fix vulnerability in v1 of loader-utils · Issue #218 · webpack/loader-utils · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants