Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-m5ae-uc68-d3g2
Vulnerability ID VCID-m5ae-uc68-d3g2
Aliases CVE-2022-21824
Summary Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') This advisory has been marked as a false positive.
Status Published
Exploitability 0.5
Weighted Severity 7.4
Risk 3.7
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
System Score Found at
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00335 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00505 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.0066 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
cvssv3.1 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
https://api.first.org/data/v1/epss?cve=CVE-2022-21824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1431042
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
https://security.netapp.com/advisory/ntap-20220325-0007/
https://security.netapp.com/advisory/ntap-20220729-0004/
https://www.debian.org/security/2022/dsa-5170
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
1004177 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004177
2040862 https://bugzilla.redhat.com/show_bug.cgi?id=2040862
CVE-2022-21824 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
GLSA-202405-29 https://security.gentoo.org/glsa/202405-29
RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044
RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830
RHSA-2022:9073 https://access.redhat.com/errata/RHSA-2022:9073
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.56372
EPSS Score 0.00335
Published At April 21, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:36.442453+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/mysql-connector-java/CVE-2022-21824.yml 38.0.0