Search for vulnerabilities
Vulnerability details: VCID-qzku-bmyx-aaan
Vulnerability ID VCID-qzku-bmyx-aaan
Aliases CVE-2022-21824
Summary Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Status Published
Exploitability 0.5
Weighted Severity 7.4
Risk 3.7
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2022:4914
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00277 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00345 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00358 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00404 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00422 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00616 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.00967 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01073 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01366 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.01510 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
epss 0.03629 https://api.first.org/data/v1/epss?cve=CVE-2022-21824
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=2040862
cvssv3.1 4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 6.4 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
cvssv3 8.2 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
cvssv3.1 8.2 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
cvssv3.1 5.3 https://www.oracle.com/security-alerts/cpuapr2022.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuapr2022.html
cvssv3.1 7.5 https://www.oracle.com/security-alerts/cpujul2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujul2022.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
https://api.first.org/data/v1/epss?cve=CVE-2022-21824
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1431042
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
https://security.netapp.com/advisory/ntap-20220325-0007/
https://security.netapp.com/advisory/ntap-20220729-0004/
https://www.debian.org/security/2022/dsa-5170
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
1004177 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004177
2040862 https://bugzilla.redhat.com/show_bug.cgi?id=2040862
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2022-21824 https://nvd.nist.gov/vuln/detail/CVE-2022-21824
GLSA-202405-29 https://security.gentoo.org/glsa/202405-29
RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044
RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830
RHSA-2022:9073 https://access.redhat.com/errata/RHSA-2022:9073
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21824.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21824
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.oracle.com/security-alerts/cpujul2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.50783
EPSS Score 0.00277
Published At April 18, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.