CVE-2022-37601

Publicada em 12 out 2022 · Atualizada em 28 out 2024

Seguir esta CVE + Monitorar node-loader-utils + Monitorar loader-utils

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.5%

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Produtos afetados

n/a · n/a

Referências

https://dl.acm.org/doi/abs/10.1145/3488932.3497769 https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11 https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 https://github.com/webpack/loader-utils/issues/212 https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf