High severity · published Feb 24, 2022
CVE-2022-21824
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…
8.2
CVSS
21.5%
EPSS
No
On KEV
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)21.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
MC
Mysql Cluster · Oracle
through 8.0.29 · source: NVD
MC
Mysql Connectors · Oracle
through 8.0.28 · source: NVD
ME
Mysql Enterprise Monitor · Oracle
through 8.0.29 · source: NVD
MS
Mysql Server · Oracle
through 8.0.29 · source: NVD
MW
Mysql Workbench · Oracle
through 8.0.28 · source: NVD
NO
Node.js · Nodejs
12.0.0 before 12.22.9; 14.0.0 before 14.18.3; 16.0.0 before 16.13.2; 17.0.0 before 17.3.1 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
SN
Snapcenter · Netapp
All versions, or not specified · source: NVD