CVE-2022-21190: Prototype Pollution
This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.proto or foo.this.constructor.prototype.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21190?
CVE-2022-21190 has a severity rating that requires immediate attention as it indicates a bypass vulnerability in the convict package.
How do I fix CVE-2022-21190?
To fix CVE-2022-21190, upgrade the convict package to version 6.2.3 or later.
What software is affected by CVE-2022-21190?
CVE-2022-21190 affects the convict package versions prior to 6.2.3.
What type of vulnerability is CVE-2022-21190?
CVE-2022-21190 is categorized as a bypass vulnerability.
Is CVE-2022-21190 related to another vulnerability?
Yes, CVE-2022-21190 is a bypass of CVE-2022-22143, highlighting an extended vulnerability in the convict package.