Vulnerability Details CVE-2022-37616
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 78.1%
CVSS Severity
CVSS v3 Score 9.8
References
- http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
- https://dl.acm.org/doi/abs/10.1145/3488932.3497769
- https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
- https://github.com/xmldom/xmldom/issues/436
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560
- https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
- https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
- http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
- https://dl.acm.org/doi/abs/10.1145/3488932.3497769
- https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
- https://github.com/xmldom/xmldom/issues/436
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560
- https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
- https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
Products affected by CVE-2022-37616
-
cpe:2.3:a:xmldom_project:xmldom:-
-
cpe:2.3:a:xmldom_project:xmldom:0.1.0
-
cpe:2.3:a:xmldom_project:xmldom:0.1.1
-
cpe:2.3:a:xmldom_project:xmldom:0.1.10
-
cpe:2.3:a:xmldom_project:xmldom:0.1.11
-
cpe:2.3:a:xmldom_project:xmldom:0.1.12
-
cpe:2.3:a:xmldom_project:xmldom:0.1.13
-
cpe:2.3:a:xmldom_project:xmldom:0.1.14
-
cpe:2.3:a:xmldom_project:xmldom:0.1.15
-
cpe:2.3:a:xmldom_project:xmldom:0.1.16
-
cpe:2.3:a:xmldom_project:xmldom:0.1.17
-
cpe:2.3:a:xmldom_project:xmldom:0.1.18
-
cpe:2.3:a:xmldom_project:xmldom:0.1.19
-
cpe:2.3:a:xmldom_project:xmldom:0.1.2
-
cpe:2.3:a:xmldom_project:xmldom:0.1.20
-
cpe:2.3:a:xmldom_project:xmldom:0.1.21
-
cpe:2.3:a:xmldom_project:xmldom:0.1.22
-
cpe:2.3:a:xmldom_project:xmldom:0.1.24
-
cpe:2.3:a:xmldom_project:xmldom:0.1.25
-
cpe:2.3:a:xmldom_project:xmldom:0.1.26
-
cpe:2.3:a:xmldom_project:xmldom:0.1.27
-
cpe:2.3:a:xmldom_project:xmldom:0.1.29
-
cpe:2.3:a:xmldom_project:xmldom:0.1.3
-
cpe:2.3:a:xmldom_project:xmldom:0.1.30
-
cpe:2.3:a:xmldom_project:xmldom:0.1.31
-
cpe:2.3:a:xmldom_project:xmldom:0.1.4
-
cpe:2.3:a:xmldom_project:xmldom:0.1.5
-
cpe:2.3:a:xmldom_project:xmldom:0.1.6
-
cpe:2.3:a:xmldom_project:xmldom:0.1.7
-
cpe:2.3:a:xmldom_project:xmldom:0.1.8
-
cpe:2.3:a:xmldom_project:xmldom:0.1.9
-
cpe:2.3:a:xmldom_project:xmldom:0.2.0
-
cpe:2.3:a:xmldom_project:xmldom:0.2.1
-
cpe:2.3:a:xmldom_project:xmldom:0.3.0
-
cpe:2.3:a:xmldom_project:xmldom:0.4.0
-
cpe:2.3:a:xmldom_project:xmldom:0.5.0
-
cpe:2.3:a:xmldom_project:xmldom:0.6.0
-
cpe:2.3:a:xmldom_project:xmldom:0.7.0
-
cpe:2.3:a:xmldom_project:xmldom:0.7.1
-
cpe:2.3:a:xmldom_project:xmldom:0.7.2
-
cpe:2.3:a:xmldom_project:xmldom:0.7.3
-
cpe:2.3:a:xmldom_project:xmldom:0.7.4
-
cpe:2.3:a:xmldom_project:xmldom:0.7.5
-
cpe:2.3:a:xmldom_project:xmldom:0.8.0
-
cpe:2.3:a:xmldom_project:xmldom:0.8.1
-
cpe:2.3:a:xmldom_project:xmldom:0.8.2
-
cpe:2.3:a:xmldom_project:xmldom:0.9.0
-
cpe:2.3:o:debian:debian_linux:10.0