Arbitrary Code Execution
CVE-2022-25921

8.1HIGH

Key Information:

Vendor

Morgan-json Project

Status
Morgan-json
Vendor
CVE Published:
29 August 2022

What is CVE-2022-25921?

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.

Affected Version(s)

morgan-json 0

References

https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193
x_refsource_MISC
https://github.com/indexzero/morgan-json/blob/3a76010215a...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

OmniTaint
.