PT-2022-17615 · Liquidjs · Liquidjs

Amit777 · Published 2022-12-22 · Updated 2022-12-30 · CVE-2022-25948

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions liquidjs versions prior to 10.0.0

Description The issue concerns Information Exposure when the ownPropertyOnly parameter is set to False, resulting in the leaking of properties of a prototype.

Recommendations For versions 9.34.0 and higher, consider using the provided option to disable this functionality as a workaround. For versions prior to 9.34.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-25948

GHSA-45RM-2893-5F49

Affected Products

Liquidjs

References · 10

• 🔥 https://github.com/harttle/liquidjs/issues/454 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868 · Exploit
• https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db · Patch
• https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208 · Patch
• https://osv.dev/vulnerability/CVE-2022-25948 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45rm-2893-5f49 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25948 · Security Note
• https://github.com/harttle/liquidjs · Note
• https://t.me/cvenotify/40407 · Telegram Post
• https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ · Note