Vulnerability · Published Jul 28, 2022 · Assigned by @huntrdev
CVE-2022-2564Prototype Pollution in automattic/mongoose
High 7.0
In plain English
A high-severity prototype pollution in automattic/mongoose from automattic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 31.3% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)7.0High
Exploit odds (30 days)31.3%top 1.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | mongoose | 6.4.6 | GHSA-f825-f98c-gj3g |
| npm | mongoose | 5.13.15 | GHSA-f825-f98c-gj3g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| automattic | automattic/mongoose | unspecified – before 6.4.6 |
Weakness: CWE-1321 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
References
- https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141 x_refsource_MISC
- https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd x_refsource_CONFIRM
- https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8 x_refsource_MISC
- https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6 x_refsource_MISC