7.1

CVE-2022-41940

Exploit

Uncaught exception in engine.io 

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Socket ≫ Engine.Io SwPlatformnode.js Version < 3.6.1
Socket ≫ Engine.Io SwPlatformnode.js Version >= 4.0.0 < 6.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.94% 0.775
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 7.1 1.6 5.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-248 Uncaught Exception

An exception is thrown from a function, but it is not caught.

https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
Patch
Third Party Advisory
https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
Patch
Third Party Advisory
https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
Third Party Advisory
Exploit