exploitDog

CVE-2022-25906

Опубликовано: 01 фев. 2023

Источник: nvd

CVSS3: 7.4

CVSS3: 7.8

EPSS Низкий

Описание

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

Ссылки

https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
Broken Link
https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878
Exploit
Third Party Advisory
https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
Broken Link
https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:is-http2_project:is-http2:-:*:*:*:*:node.js:*:*

EPSS

Процентиль: 28%

0.00096

Низкий

7.4 High

CVSS3

7.8 High

CVSS3

Дефекты

CWE-78

CWE-78

CWE-78

Связанные уязвимости

GHSA-2275-rpf5-xv8h

CVSS3: 7.8

github

больше 2 лет назад

is-http2 vulnerable to Improper Input Validation

EPSS

Процентиль: 28%

0.00096

Низкий

7.4 High

CVSS3

7.8 High

CVSS3

Дефекты

CWE-78

CWE-78

CWE-78