Vulnerability Description
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Set-In Project | Set-In | < 2.0.3 |
Related Weaknesses (CWE)
References
- https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f34Broken Link
- https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc842081PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-SETIN-2388571ExploitPatchThird Party Advisory
- https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f34Broken Link
- https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc842081PatchThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-SETIN-2388571ExploitPatchThird Party Advisory
FAQ
What is CVE-2022-25354?
CVE-2022-25354 is a vulnerability with a CVSS score of 8.6 (HIGH). The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an in...
How severe is CVE-2022-25354?
CVE-2022-25354 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-25354?
Check the references section above for vendor advisories and patch information. Affected products include: Set-In Project Set-In.