Prototype Pollution Vulnerability in Browserify-Shim by Thlorenz
CVE-2022-37621

9.8CRITICAL

Key Information:

Vendor: Browserify-shim Project
Status: Browserify-shim
Vendor: CVE Published:; 28 October 2022

🔔 Create Browserify-shim Project Vulnerability Alert

What is CVE-2022-37621?

A prototype pollution vulnerability exists in the 'resolveShims' function of the 'resolve-shims.js' file within the 'browserify-shim' library. This vulnerability is exploited through the 'fullPath' variable, which could allow attackers to manipulate the prototype of an object, potentially leading to unintended behavior in applications relying on the library. Developers using version 3.8.15 should assess their usage and consider implementing patches or updates to mitigate associated risks.

References

https://github.com/thlorenz/browserify-shim/blob/464b32bb...

https://github.com/thlorenz/browserify-shim/issues/247

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 28, 2022
Vulnerability Reserved
Aug 8, 2022

CVE-2022-37621 Data

JSON