Paper/Archive/CVE-2022-2564

CVE-2022-2564

automattic automattic/mongoose — Prototype Pollution in automattic/mongoose

EPSS 31%public exploit CVSS 9.8

critical.is priorityof 100

59

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.3.983 × 2019.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

Affected

ProductAffectedFixed inSource

automattic/mongooseunspecified – < 6.4.66.4.6CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

@huntrdev (CNA)7.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141 refhuntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd refgithub.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8 refgithub.com/Automattic/mongoose/compare/6.4.5...6.4.6