Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
References
Configurations
History
21 Nov 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf - Technical Description | |
| References | () https://dl.acm.org/doi/abs/10.1145/3488932.3497769 - Technical Description | |
| References | () https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 - Technical Description | |
| References | () https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11 - Product | |
| References | () https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 - Product | |
| References | () https://github.com/webpack/loader-utils/issues/212 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html - Third Party Advisory |
14 May 2024, 11:13
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. |
Information
Published : 2022-10-12 20:15
Updated : 2024-11-21 07:15
NVD link : CVE-2022-37601
Mitre link : CVE-2022-37601
CVE.ORG link : CVE-2022-37601
JSON object : View
Products Affected
webpack.js
- loader-utils
debian
- debian_linux
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')