Full stack solution using Vue.js, Azure Static Web Apps, Azure Function, Azure SQL Database and a microservice architecture to monitor in real-time public transportation data, create a geofence and send notification when geofence is activated
MIT License
0
stars
0
forks
source link
CVE-2022-37616 (Critical) detected in xmldom-0.7.5.tgz #36
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
CVE-2022-37616 - Critical Severity Vulnerability
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz
Path to dependency file: /azure-function/node/package.json
Path to vulnerable library: /azure-function/node/node_modules/@xmldom/xmldom/package.json
Dependency Hierarchy: - mssql-6.3.1.tgz (Root Library) - tedious-6.7.1.tgz - ms-rest-nodeauth-3.1.0.tgz - adal-node-0.2.3.tgz - :x: **xmldom-0.7.5.tgz** (Vulnerable Library)
Found in HEAD commit: 43865d4f6b2ee0eeedf98bd8edb8aff4c6e1a637
Found in base branch: main
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Publish Date: 2022-10-11
URL: CVE-2022-37616
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37616
Release Date: 2022-10-11
Fix Resolution (@xmldom/xmldom): 0.7.6
Direct dependency fix Resolution (mssql): 6.3.2
Step up your Open Source Security Game with Mend here