CVE-2022-32223
First published: Thu Jul 14 2022(Updated: )
Node.js could allow a local attacker to gain elevated privileges on the system, caused by the DLL search order hijacking of providers.dll. By placing a specially crafted file, an attacker could exploit this vulnerability to escalate privileges.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cognos Controller | <=11.0.0 - 11.0.1 | |
| Node.js | >=14.0.0<=14.14.0 | |
| Node.js | >=14.14.0<14.20.0 | |
| Node.js | >=16.0.0<=16.12.0 | |
| Node.js | >=16.13.0<16.16.0 | |
| Node.js | >=18.0.0<18.0.5 | |
| Microsoft Windows Operating System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-32223?
CVE-2022-32223 is a vulnerability in Node.js that allows hijacking the execution flow through DLL hijacking on Windows platforms.
What is the severity of CVE-2022-32223?
The severity of CVE-2022-32223 is high, with a CVSS score of 7.3.
How can CVE-2022-32223 be exploited?
CVE-2022-32223 can be exploited if the victim has specific dependencies on a Windows machine, including having OpenSSL installed and a particular file path present.
Which versions of Node.js are affected by CVE-2022-32223?
Node.js versions 14.0.0 to 14.14.0 (inclusive), versions 14.14.0 to 14.20.0 (exclusive) with LTS tag, versions 16.0.0 to 16.12.0 (inclusive), versions 16.13.0 to 16.16.0 (exclusive) with LTS tag, and versions 18.0.0 to 18.0.5 (exclusive) are affected by CVE-2022-32223.
How do I fix CVE-2022-32223?
Users should upgrade their Node.js installations to the patched versions mentioned in the security advisories.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm cognos controller
- version/ibm cognos controller/11.0.0 - 11.0.1
- vendor/nodejs
- canonical/node.js
- version/node.js/14.0.0
- version/node.js/14.14.0
- version/node.js/16.0.0
- version/node.js/16.12.0
- version/node.js/16.13.0
- version/node.js/18.0.0
- vendor/microsoft
- canonical/microsoft windows operating system