Main Vulnerability Database Vulnerabilities #VU88944

Prototype pollution in plist.js - CVE-2022-22912

Published: April 24, 2024

Vulnerability identifier: #VU88944

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22912

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Affected software

plist.js
MobileFirst Platform

How to mitigate CVE-2022-22912

Install update from vendor's website.

plist.js - update to 3.0.5
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031

External References

https://github.com/TooTallNate/plist.js/issues/114

Related Security Bulletins