CVE-2022-25862 — MEDIUM (4.0)

Vulnerability Description

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123)

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Sds Project	Sds	All versions

Related Weaknesses (CWE)

CWE-1321

References

https://github.com/monsterkodi/sds/blob/master/js/set.jsThird Party Advisory
https://snyk.io/vuln/SNYK-JS-SDS-2385944ExploitThird Party Advisory
https://github.com/monsterkodi/sds/blob/master/js/set.jsThird Party Advisory
https://snyk.io/vuln/SNYK-JS-SDS-2385944ExploitThird Party Advisory

FAQ

What is CVE-2022-25862?

CVE-2022-25862 is a vulnerability with a CVSS score of 4.0 (MEDIUM). This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulne...

How severe is CVE-2022-25862?

CVE-2022-25862 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25862?

Check the references section above for vendor advisories and patch information. Affected products include: Sds Project Sds.