PT-2022-23898

CVE-2022-37257

Published

2022-09-15

Updated

2022-09-19

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions stealjs steal version 2.2.4

Description The issue is related to a prototype pollution vulnerability in the convertLater function in npm-convert.js. This vulnerability is exploited via the requestedVersion variable in npm-convert.js.

Recommendations For stealjs steal version 2.2.4, consider disabling the convertLater function as a temporary workaround until a patch is available. Restrict access to the npm-convert.js file to minimize the risk of exploitation. Avoid using the requestedVersion variable in the affected convertLater function until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Secdevlpr26

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers

CVE-2022-37257