Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2022-37601

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

VectorNETWORK

PublishedOct 12, 2022, 20:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

loader-utils(npm)2.0.02.0.3N/A

loader-utils(npm)01.4.1N/A

References

http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
https://dl.acm.org/doi/abs/10.1145/3488932.3497769
https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11
https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47
https://github.com/webpack/loader-utils/issues/212
https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884
https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html

Weakness Type

CWE-1321

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK