PT-2022-24023

CVE-2022-37602

Published

2022-10-14

Updated

2022-10-15

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions karma-runner grunt-karma version 4.0.1

Description The issue is related to a prototype pollution vulnerability in the karma-runner grunt-karma. It occurs via the key variable in grunt-karma.js.

Recommendations For version 4.0.1, consider restricting access to the grunt-karma.js file or the key variable until a patch is available. As a temporary workaround, avoid using the key variable in the affected grunt-karma.js file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Secdevlpr26

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers

CVE-2022-37602