Prototype pollution in loader-utils - CVE-2022-37601

Vulnerability identifier: #VU70123

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37601

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform prototype pollution attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the parseQuery() function in parseQuery.js. A remote attacker can inject and execute arbitrary JavaScript code.

loader-utils
IBM Engineering Requirements Quality Assistant
DB2 Data Management Console
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Storage Fusion Data Foundation
Cloud Pak for Security (CP4S)
IBM Process Mining
Jira Service Management Data Center
Red Hat Migration Toolkit for Applications
Confluence Data Center
Jira Software Data Center
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Spectrum Discover
IBM Cloud Pak for Multicloud Management Security Services
QRadar User Behavior Analytics
IBM Decision Optimization for Cloud Pak for Data
App Connect Enterprise Certified Container
OpenShift Logging
IBM Edge Application Manager
Splunk Enterprise Security (ES)
Splunk Enterprise
Confluence Server
IBM QRadar Use Case Manager

Install update from vendor's website.

loader-utils - addressed in versions 1.4.1, 2.0.3, 3.2.0
Cloud Pak for Security (CP4S) - update to 1.10.15.0
IBM Process Mining - update to 2.0
DB2 Data Management Console - update to 3.1.13.2
Splunk Enterprise Security (ES) - addressed in versions 7.1.2, 7.2.0, 7.3.0
Jira Service Management Data Center - update to 10.3.23
Red Hat Migration Toolkit for Applications - update to 6.0.1
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1, 9.2.8, 9.3.6, 9.4.4, 10.0.1
Confluence Server - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Confluence Data Center - addressed in versions 9.2.1, 9.4.0, 9.5.1, 10.0.2
Jira Software Data Center - update to 10.3.22
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-4
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
IBM QRadar Use Case Manager - update to 3.8.0
QRadar User Behavior Analytics - update to 4.1.11
IBM Decision Optimization for Cloud Pak for Data - update to 4.6.1
DB2 on Cloud Pak for Data - update to 4.6.2
DB2 Warehouse on Cloud Pak for Data - update to 4.6.2
Storage Fusion Data Foundation - update to 4.18.2
App Connect Enterprise Certified Container - addressed in versions 5.0.2, 6.1.0
OpenShift Logging - update to 5.6.0

• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11
• https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47
• https://github.com/webpack/loader-utils/issues/212

• Prototype pollution in webpack loader-utils
• Prototype pollution in IBM Cloud Pak for Integration
• Prototype pollution in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• App Connect Enterprise Certified Container update for loader-utils
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Engineering Requirements Quality Assistant On-Premises
• Multiple vulnerabilities in IBM Spectrum Discover
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM QRadar Use Case Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Splunk Enterprise Security (ES) update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Storage Fusion Data Foundation
• Splunk Enterprise Security update for third-party components
• Confluence Data Center and Server update for loader-utils
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center