PT-2021-6095 · Node.Js+8 · Node.Js+8

Published 2021-08-20 · Updated 2024-12-16 · CVE-2022-21824

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 12.22.9 Node.js versions prior to 14.18.3 Node.js versions prior to 16.13.2 Node.js versions prior to 17.3.1

Description The issue is related to the formatting logic of the console.table() function, which allows user-controlled input to be passed to the properties parameter. This can lead to prototype pollution, enabling an attacker to assign an empty string to numerical keys of the object prototype. The pollution has limited control.

Recommendations For Node.js versions prior to 12.22.9, update to version 12.22.9 or later. For Node.js versions prior to 14.18.3, update to version 14.18.3 or later. For Node.js versions prior to 16.13.2, update to version 16.13.2 or later. For Node.js versions prior to 17.3.1, update to version 17.3.1 or later.

Fix

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-915

CWE-94

CWE-471

Related Identifiers

ALSA-2022:7830

ALSA-2022:9073

ALT-PU-2022-1760

ALT-PU-2022-1799

ALT-PU-2022-2552

ALT-PU-2022-3073

ALT-PU-2022-3102

ALT-PU-2023-1461

ALT-PU-2023-1912

AZL-8864

BDU:2022-00760

BIT-NODE-2022-21824

BIT-NODE-MIN-2022-21824

CESA-2022_7830

CESA-2022_9073

CVE-2022-21824

DLA-3137-1

DSA-5170-1

MGASA-2022-0077

OESA-2022-1620

OPENSUSE-SU-2022:0112-1

OPENSUSE-SU-2022:0113-1

OPENSUSE-SU-2022_0112-1

OPENSUSE-SU-2022_0113-1

OPENSUSE-SU-2022_1717-1

OPENSUSE-SU-2024:11730-1

OPENSUSE-SU-2024:11746-1

RHSA-2022:4914

RHSA-2022:7044

RHSA-2022:7830

RHSA-2022:9073

RHSA-2022_7830

RHSA-2022_9073

RHSA-2023:1742

RLSA-2022:7830

RLSA-2022:9073

SUSE-SU-2022:0101-1

SUSE-SU-2022:0112-1

SUSE-SU-2022:0113-1

SUSE-SU-2022:0114-1

SUSE-SU-2022:0570-1

SUSE-SU-2022:1717-1

SUSE-SU-2022_1717-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Node.Js

Red Hat

Red Os

Rocky Linux

Suse

References · 155

• https://osv.dev/vulnerability/ALSA-2022:7830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27290 · Security Note
• https://errata.almalinux.org/8/ALSA-2022-7830.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2022-21824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22959 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21824 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:9073 · Vendor Advisory
• https://debian.org/security/2022/dsa-5170 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:9073 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0113-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3137-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0112-1 · Vendor Advisory