by Kastro
Paper/Archive/CVE-2022-25962

CVE-2022-25962

snyk — All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.5.625 × 2012.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.

Affected

ProductAffectedFixed inSource
vagrant.jsall versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitsecurity.snyk.io/vuln/SNYK-JS-VAGRANTJS-3175614