CVE-2022-25871 - Prototype Pollution

Back Back to CVE browser

HIGH

Prototype Pollution

Published Jun 17, 2022

7.5

HIGH

CVSS 3.1

EPSS 1.16%

Description

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).

Affected products

Vendor n/a Product Querymen Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Querymen

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
npm	querymen	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1321

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6101
Advisory
https://github.com/advisories/GHSA-p23c-p8w2-ww5v
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25871
https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6101		Advisory
https://github.com/advisories/GHSA-p23c-p8w2-ww5v		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25871
https://snyk.io/vuln/SNYK-JS-QUERYMEN-2391488		x_refsource_MISCExploitThird Party Advisory