PT-2022-17573 · Sds · Sds

Cristian-Alexandru Staicu + 3 · Published 2022-05-13 · Updated 2022-05-24 · CVE-2022-25862

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sds versions 0.0.0 and later

Description The issue allows the library to be tricked into adding or modifying properties of the Object.prototype. This is achieved by abusing the set function located in js/set.js.

Recommendations For sds version 0.0.0, consider restricting access to the set function in js/set.js to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-25862

GHSA-PH28-WWFJ-FV7F

SNYK-JS-SDS-2385944

Affected Products

Sds

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-SDS-2385944 · Exploit
• https://osv.dev/vulnerability/GHSA-ph28-wwfj-fv7f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25862 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7618 · Security Note
• https://github.com/monsterkodi/sds/blob/master/js/set.js · Note
• https://github.com/monsterkodi/sds · Note
• https://t.me/cibsecurity/42696 · Telegram Post