This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
History

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

Mon, 19 Aug 2024 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-04-12T15:20:12.370743Z

Updated: 2024-09-16T16:53:18.553Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-21803

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-04-12T16:15:08.480

Modified: 2024-11-21T06:45:28.023

Link: CVE-2022-21803

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-04-12T00:00:00Z

Links: CVE-2022-21803 - Bugzilla