요약
- CVE-2022-25878은(는) protobufjs (protobufjs project), protobufjs에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 2.3%, 전체 취약점의 83.5%보다 높음.
- 조치: 6.11.3, 6.10.3 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| protobufjs | < 6.11.3
| 6.11.3
|
| protobufjs npm | ≥ 6.10.0, < 6.10.3≥ 6.11.0, < 6.11.3
| 6.10.36.11.3
|
Description
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.
This vulnerability can occur in multiple ways:
- by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
- by parsing/loading .proto files
NVD description
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free