9.8

CVE-2022-39353

Exploit

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

Data is provided by the National Vulnerability Database (NVD)
Xmldom Project ≫ Xmldom SwPlatformnode.js Version < 0.6.0
Xmldom Project ≫ Xmldom SwPlatformnode.js Version >= 0.7.0 < 0.7.7
Xmldom Project ≫ Xmldom SwPlatformnode.js Version >= 0.8.0 < 0.8.4
Xmldom Project ≫ Xmldom Version0.9.0 Updatebeta1 SwPlatformnode.js
Xmldom Project ≫ Xmldom Version0.9.0 Updatebeta2 SwPlatformnode.js
Xmldom Project ≫ Xmldom Version0.9.0 Updatebeta3 SwPlatformnode.js
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.13% 0.775
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 9.4 3.9 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CWE-1288 Improper Validation of Consistency within Input

The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/jindw/xmldom/issues/150
Third Party Advisory
Exploit
Issue Tracking