9.8
CVE-2022-25893
- EPSS 1.43%
- Veröffentlicht 21.12.2022 05:15:11
- Zuletzt bearbeitet 15.04.2025 20:15:35
- Quelle report@snyk.io
- CVE-Watchlists
- Unerledigt
LoginArbitrary Code Execution
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vm2 Project ≫ Vm2 SwPlatformnode.js Version < 3.9.10
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.43% | 0.695 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| report@snyk.io | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-471 Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
https://github.com/patriksimek/vm2/issues/444
https://github.com/patriksimek/vm2/pull/445
https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69
https://security.snyk.io/vuln/SNYK-JS-VM2-2990237