Description

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Remediation

References

https://csirt.divd.nl/CVE-2022-2421

https://csirt.divd.nl/DIVD-2022-00045

Related Vulnerabilities

CVE-2021-29369 Vulnerability in npm package gnuplot

CVE-2018-20433 Vulnerability in maven package c3p0:c3p0

CVE-2019-10418 Vulnerability in maven package io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps

CVE-2017-16005 Vulnerability in npm package http-signature

CVE-2018-16487 Vulnerability in npm package lodash.defaultsdeep

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory NVD-CWE-noinfo