CVE-2022-25878 — HIGH (8.2)

Q: How severe is CVE-2022-25878?

CVE-2022-25878 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-25878?

Check the references section above for vendor advisories and patch information. Affected products include: Protobufjs Project Protobufjs.

Vulnerability Description

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

CVSS Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Protobufjs Project	Protobufjs	< 6.11.3

Related Weaknesses (CWE)

CWE-1321

References

https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca3Broken Link
https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73fPatchThird Party Advisory
https://github.com/protobufjs/protobuf.js/pull/1731PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248ExploitPatchThird Party Advisory
https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca3Broken Link
https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73fPatchThird Party Advisory
https://github.com/protobufjs/protobuf.js/pull/1731PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507ExploitPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248ExploitPatchThird Party Advisory

FAQ

What is CVE-2022-25878?

CVE-2022-25878 is a vulnerability with a CVSS score of 8.2 (HIGH). The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: ...

How severe is CVE-2022-25878?

CVE-2022-25878 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25878?

Check the references section above for vendor advisories and patch information. Affected products include: Protobufjs Project Protobufjs.