Search for vulnerabilities
Vulnerability details: VCID-2vqy-3hmp-yyfe
Vulnerability ID VCID-2vqy-3hmp-yyfe
Aliases CVE-2022-21824
Summary Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Status Published
Exploitability 0.5
Weighted Severity 7.4
Risk 3.7
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
System Score Found at
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00255 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00317 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00317 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00329 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
cvssv3.1 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 6.4 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
cvssv3.1 8.2 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
https://api.first.org/data/v1/epss?cve=CVE-2022-21824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1431042
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
https://security.netapp.com/advisory/ntap-20220325-0007/
https://security.netapp.com/advisory/ntap-20220729-0004/
https://www.debian.org/security/2022/dsa-5170
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
1004177 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004177
2040862 https://bugzilla.redhat.com/show_bug.cgi?id=2040862
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2022-21824 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044
RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830
RHSA-2022:9073 https://access.redhat.com/errata/RHSA-2022:9073
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.48912
EPSS Score 0.00255
Published At Aug. 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:28:56.176407+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.15/community.json 37.0.0