Cyber Resilience

CVE-2022-25878

HighPublic PoC

Published: 27 May 2022

Published
27 May 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0042 62.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-25878 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Protobufjs Project Protobufjs. Its CVSS base score is 8.2 (High).

Operationally, ranked in the top 37.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions…

more

2. by parsing/loading .proto files

CWE(s)
CWE-1321

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

protobufjs project
protobufjs
≤ 6.11.3

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References