PT-2022-17192 · Bodymen · Bodymen

Cristian-Alexandru Staicu + 3 · Published 2022-03-17 · Updated 2022-03-24 · CVE-2022-25296

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bodymen versions 0.0.0 and later

Description The issue allows for Prototype Pollution via the handler function, which can be tricked into adding or modifying properties of Object.prototype using a proto payload.

Recommendations For bodymen versions 0.0.0 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-25296

GHSA-VHXC-FHM5-QCP9

SNYK-JS-BODYMEN-2342623

Affected Products

Bodymen

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-BODYMEN-2342623 · Exploit
• https://osv.dev/vulnerability/CVE-2022-25296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25296 · Security Note
• https://osv.dev/vulnerability/GHSA-vhxc-fhm5-qcp9 · Vendor Advisory
• https://github.com/diegohaz/bodymen · Note
• https://t.me/cibsecurity/39138 · Telegram Post