Prototype Pollution in Protobufjs Project
CVE-2022-25878
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.023 (82.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 82.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000
Affected products
- Protobufjs Project
- Protobufjs — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248 (Exploit, Patch, Third Party Advisory)
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507 (Exploit, Patch, Third Party Advisory)
- github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf… (Broken Link)
- github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e… (Patch, Third Party Advisory)
- github.com/protobufjs/protobuf.js/pull/1731 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-25878?
- CVE-2022-25878 is a high-severity vulnerability in Protobufjs Project, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 8.2/10. Published 2022-05-27.
- How severe is CVE-2022-25878?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2022-25878 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.