Prototype Pollution Vulnerability in Browserify-Shim by Thlorenz
CVE-2022-37623

9.8CRITICAL

Key Information:

Vendor: Browserify-shim Project
Status: Browserify-shim
Vendor: CVE Published:; 31 October 2022

🔔 Create Browserify-shim Project Vulnerability Alert

What is CVE-2022-37623?

A prototype pollution vulnerability exists in the function resolveShims within resolve-shims.js of the Browserify-Shim library by Thlorenz. This vulnerability arises through improper handling of the shimPath variable. When exploited, it may allow attackers to manipulate the prototype of an object, potentially leading to unexpected behavior in applications that use this library. It is important for developers using Browserify-Shim to review the code and apply any necessary patches to mitigate the risks associated with this vulnerability.

References

https://github.com/thlorenz/browserify-shim/blob/464b32bb...

https://github.com/thlorenz/browserify-shim/issues/248

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 31, 2022
Vulnerability Reserved
Aug 8, 2022

CVE-2022-37623 Data

JSON