PT-2022-16878 · Npm+4 · Moment.Js+5

Ichernev · Published 2022-04-04 · Updated 2026-06-04 · CVE-2022-24785

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Moment.js versions 1.0.1 through 2.29.1

Description A path traversal vulnerability impacts npm (server) users of Moment.js, especially if a user-provided locale string is directly used to switch moment locale. This issue allows an unauthenticated attacker to provide a filesystem path as invalid input. The problem is patched in version 2.29.2.

Recommendations For versions 1.0.1 through 2.29.1, update to version 2.29.2 to resolve the issue. As a temporary workaround, sanitize the user-provided locale name before passing it to Moment.js.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-27

CWE-22

Related Identifiers

BDU:2026-00718

CVE-2022-24785

DLA-3295-1

GHSA-8HFJ-J24R-96C4

MGASA-2022-0323

MGASA-2024-0067

RHSA-2022:4918

RHSA-2022:4919

RHSA-2022:6272

RHSA-2022:6277

RHSA-2023:0076

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

RHSA-2025:4226

RHSA-2025:4437

USN-5559-1

Affected Products

Astra Linux

Bitbucket

Confluence

Linuxmint

Moment.Js

Ubuntu

References · 64

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24785.json · Exploit
• https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 · Patch
• https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0323 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24785 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0323.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24785 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0067.html · Security Note
• https://osv.dev/vulnerability/USN-5559-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24785 · Vendor Advisory
• https://tenable.com/security/tns-2022-09 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24785 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24785 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5 · Vendor Advisory