CVE-2022-2421
Socket.io - Improper type validation in attachment parsing
| CVE | CVE-2022-2421 | |||||||||||
| Title | Socket.io - Improper type validation in attachment parsing | |||||||||||
| Case | DIVD-2022-00045 | |||||||||||
| Credits |
|
|||||||||||
| Affected products |
|
|||||||||||
| CVSS |
Base score:
10
(CRITICAL) |
|||||||||||
| References |
|
|||||||||||
| Problem type(s) | CWE-89 SQL Injection | |||||||||||
| Date published | 24 Oct 2022 22:00 UTC | |||||||||||
| Last modified | 02 Jan 2024 18:32 UTC |
Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
JSON version.