Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
References
| Link | Resource |
|---|---|
| https://csirt.divd.nl/DIVD-2022-00045 | Third Party Advisory |
| https://csirt.divd.nl/CVE-2022-2421 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Jan 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. |
07 Nov 2023, 03:46
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object. |
Information
Published : 2022-10-26 10:15
Updated : 2024-01-02 19:15
NVD link : CVE-2022-2421
Mitre link : CVE-2022-2421
JSON object : View
Products Affected
socket
- socket.io-parser
CWE