CVE-2022-21169 - OpenCVE

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Express Xss Sanitizer Project	Express Xss Sanitizer

Configuration 1 [-]

cpe:2.3:a:express_xss_sanitizer_project:express_xss_sanitizer:*:*:*:*:*:node.js:*:*

References

Link	Resource
https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a	Patch Third Party Advisory
https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4	Exploit Issue Tracking Third Party Advisory
https://runkit.com/embed/w306l6zfm7tu	Patch Third Party Advisory URL Repurposed
https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2022-09-26T00:00:00

Updated: 2022-09-26T05:05:11

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-21169

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-09-26T05:15:10.133

Modified: 2024-02-14T01:17:43.863

Link: CVE-2022-21169

JSON object: View

Redhat Information

No data.

CWE

CWE-1321

{"containers": {"cna": {"affected": [{"product": "express-xss-sanitizer", "vendor": "n/a", "versions": [{"lessThan": "1.1.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Jayateertha Guruprasad"}], "datePublic": "2022-09-26T00:00:00", "descriptions": [{"lang": "en", "value": "The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "integrityImpact": "LOW", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 6.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Prototype Pollution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-26T05:05:11", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4"}, {"tags": ["x_refsource_MISC"], "url": "https://runkit.com/embed/w306l6zfm7tu"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a"}], "title": "Prototype Pollution", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-09-26T05:00:10.103193Z", "ID": "CVE-2022-21169", "STATE": "PUBLIC", "TITLE": "Prototype Pollution"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "express-xss-sanitizer", "version": {"version_data": [{"version_affected": "<", "version_value": "1.1.3"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "Jayateertha Guruprasad"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Prototype Pollution"}]}]}, "references": {"reference_data": [{"name": "https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443", "refsource": "MISC", "url": "https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443"}, {"name": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4", "refsource": "MISC", "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4"}, {"name": "https://runkit.com/embed/w306l6zfm7tu", "refsource": "MISC", "url": "https://runkit.com/embed/w306l6zfm7tu"}, {"name": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a", "refsource": "MISC", "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a"}]}}}}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-21169", "datePublished": "2022-09-26T00:00:00", "dateReserved": "2022-02-24T00:00:00", "dateUpdated": "2022-09-26T05:05:11", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:express_xss_sanitizer_project:express_xss_sanitizer:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5A82E346-B772-4081-BD07-2911862E9945", "versionEndExcluding": "1.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization."}, {"lang": "es", "value": "El paquete express-xss-sanitizer versiones anteriores a 1.1.3, es vulnerable a una Contaminaci\u00f3n de Prototipos por medio del atributo allowedTags, permitiendo al atacante omitir el saneo de tipo xss."}], "id": "CVE-2022-21169", "lastModified": "2024-02-14T01:17:43.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "report@snyk.io", "type": "Secondary"}]}, "published": "2022-09-26T05:15:10.133", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/3bf8aaaf4dbb1c209dcb8d87a82711a54c1ab39a"}, {"source": "report@snyk.io", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/issues/4"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory", "URL Repurposed"], "url": "https://runkit.com/embed/w306l6zfm7tu"}, {"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://security.snyk.io/vuln/SNYK-JS-EXPRESSXSSSANITIZER-3027443"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "nvd@nist.gov", "type": "Primary"}]}