CVE-2022-25948: Information Exposure
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25948?
The severity of CVE-2022-25948 is medium with a CVSS score of 5.3.
How does CVE-2022-25948 result in information exposure?
CVE-2022-25948 can result in information exposure when the ownPropertyOnly parameter is set to False, which leaks properties of a prototype.
How can I fix CVE-2022-25948?
For versions 9.34.0 and higher of liquidjs, you can disable the functionality that causes the vulnerability.
What is the affected software of CVE-2022-25948?
The affected software of CVE-2022-25948 is liquidjs versions before 10.0.0.
Is there any reference for CVE-2022-25948?
Yes, you can find references for CVE-2022-25948 at the following links: [Reference 1](https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db), [Reference 2](https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208), [Reference 3](https://github.com/harttle/liquidjs/issues/454)