CVE Vulnerability

CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 Patch
https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4 Vendor Advisory
https://www.tenable.com/security/tns-2022-09 Patch Release Notes
https://security.netapp.com/advisory/ntap-20220513-0006/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/ Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*
cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:*
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Information

Published : 2022-04-04 05:15

Updated : 2023-02-16 07:27

NVD link : CVE-2022-24785

Mitre link : CVE-2022-24785

Products Affected

Active Iq

Netapp

CWE
CWE-22

CWE-27

Path Traversal: 'dir/../../filename'