Prototype pollution in json5 - CVE-2022-46175

Vulnerability identifier: #VU71577

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-46175

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
json5
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
DB2 Data Management Console
Storage Fusion Data Foundation
Business Automation Insights
Cognos Analytics Mobile (iOS)
Cognos Analytics Mobile (Android)
IBM Planning Analytics Workspace
IBM Watson Machine Learning Accelerator
Cloud Pak for Network Automation
QRadar Deployment Intelligence App
Dell Policy Manager for Secure Connect Gateway (SCG)
gts
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management
IBM Edge Application Manager
Cloud Pak for Security (CP4S)
IBM QRadar Data Synchronization App
IBM Process Mining
OpenShift Logging
Confluence Data Center
Red Hat Migration Toolkit for Applications
Bitbucket Data Center
IBM Cloud Pak for Business Automation
Spectrum Discover
IBM Fusion HCI
Red Hat OpenShift Dev Spaces
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Splunk Enterprise Security (ES)
IBM Cloud Pak System
Red Hat Single Sign-On
Splunk Enterprise
IBM Security QRadar Analyst Workflow
Bitbucket Server
IBM App Connect Enterprise
Ubuntu
Fedora
node-json5 (Ubuntu package)
pgadmin4
rh-sso7-keycloak (Red Hat package)
Voice Gateway
OpenShift Data Foundation (formerly OpenShift Container Storage)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the JSON5.parse() function. A remote attacker can inject and execute arbitrary script code.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

• https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h
• https://github.com/json5/json5/issues/199
• https://github.com/json5/json5/issues/295
• https://github.com/json5/json5/pull/298