Home > Vulnerability Database > CVE-2022-37601

Mend.io Vulnerability Database

CVE-2022-37601

Good to know:

Date: October 11, 2022

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Language: JS

Severity Score

9.8

Related Resources (21)

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-37601

Url: http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf

Url: https://github.com/webpack/loader-utils/pull/217

Url: https://access.redhat.com/security/cve/CVE-2022-37601

Url: https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884

Url: https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html

Url: https://github.com/webpack/loader-utils/pull/220

Url: https://github.com/webpack/loader-utils

Url: https://github.com/webpack/loader-utils/commit/f4e48a232fae900237c3e5ff7b57ce9e1c734de1

Url: https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826

Url: https://security-tracker.debian.org/tracker/CVE-2022-37601

Url: https://github.com/webpack/loader-utils/issues/212

Url: https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47

Url: https://github.com/webpack/loader-utils/releases/tag/v2.0.3

Url: https://github.com/webpack/loader-utils/commit/4504e34c4796a5836ef70458327351675aed48a5

Url: https://dl.acm.org/doi/pdf/10.1145/3488932.3497769

Url: https://dl.acm.org/doi/abs/10.1145/3488932.3497769

Url: https://github.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c

Url: https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11

Url: https://github.com/webpack/loader-utils/releases/tag/v1.4.1

Url: https://www.mend.io/vulnerability-database/CVE-2022-37601

Severity Score

9.8

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version loader-utils - 2.0.3;loader-utils - 1.4.1

Learn More

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2022-37601

Good to know:

Date: October 11, 2022

Language: JS

Severity Score

Related Resources (21)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?