Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-04-04T00:00:00
Updated: 2023-01-31T00:00:00
Reserved: 2022-02-10T00:00:00
Link: CVE-2022-24785
JSON object: View
NVD Information
Status : Modified
Published: 2022-04-04T17:15:07.583
Modified: 2023-11-07T03:44:37.003
Link: CVE-2022-24785
JSON object: View
Redhat Information
No data.