by Kastro
Paper/Archive/CVE-2022-23923

CVE-2022-23923

snyk — Sandbox Bypass

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.1.711 × 2014.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

Affected

ProductAffectedFixed inSource
jailed< unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P

References

refsnyk.io/vuln/SNYK-JS-JAILED-2391490refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2441254