PT-2022-28063 · Unknown · Json-Pointer

Hhomar + 1 · Published 2022-12-26 · Updated 2024-05-17 · CVE-2022-4742

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions json-pointer versions up to 0.6.1

Description A critical issue has been found in the function set of the file index.js, leading to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. This issue can be exploited remotely.

Recommendations For json-pointer versions up to 0.6.1, upgrade to version 0.6.2 to address this issue. As a temporary workaround, consider restricting access to the function set of the file index.js until the upgrade is applied.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-4742

GHSA-6XRF-Q977-5VGC

Affected Products

Json-Pointer

References · 11

• https://github.com/manuelstofer/json-pointer/commit/859c9984b6c407fc2d5a0a7e47c7274daa681941 · Patch
• https://github.com/manuelstofer/json-pointer/pull/36 · Patch
• https://osv.dev/vulnerability/GHSA-6xrf-q977-5vgc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4742 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4742 · Vendor Advisory
• https://github.com/manuelstofer/json-pointer · Note
• https://t.me/cvenotify/41265 · Telegram Post
• https://vuldb.com/?id.216794 · Note
• https://vuldb.com/?ctiid.216794 · Note
• https://t.me/cvenotify/40702 · Telegram Post
• https://t.me/cvenotify/75704 · Telegram Post