CVE-2022-39357

criticalPriorität · verfolgen · 39EPSS 0.014 · 72. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.37% (72nd) EPSS

CVSS 9.8 · critical

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.1–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 2.2 · Auswirkung 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1321USprimärCWE-1321US

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

wintercms winter≤ = 1.2.0enisa_euvdEU
wintercms winter1.1.8, → 1.1.10enisa_euvdEU
wintercms winter= 1.1.8nvdUScpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*
wintercms winter= 1.1.9nvdUScpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*
wintercms winter= 1.2.0nvdUScpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*
Packagist wintercms/winter1.1.8 → 1.1.10osvUSpkg:composer/wintercms/winter
Packagist wintercms/winter1.2.0 → 1.2.1osvUSpkg:composer/wintercms/winter

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-3fh5-q6fg-w28qPrototype pollution in Snowboard framework2022-10-27ghsa · osvUS
### Impact The Snowboard framework in affected versions is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. ### Patches This issue has been patched in https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 (for 1.2) and https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f (for 1.1) and is available with Winter v1.1.10 and v1.2.1. ### Workarounds If you have not yet upgraded, or are using the 1.1 branch of Winter (1.1.8 or above), you can avoid this issue by following some common security practices for JavaScript, including implementing a [content security policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and auditing your scripts. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. ### For more information If you have any questions or comments about this advisory: - Email us at [hello@wintercms.com](mailto:hello@wintercms.com)

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2022-10-26geändert 2026-06-17

verwandt (708)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-34621US	—OT kritisch	7.23% (94th)	KEV	2026-04-11
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerab…
CVE-2019-0230US	critical9.8	96.9% (100th)	Exploit	2020-09-14
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2022-24760US	critical10.0	49.4% (99th)	Exploit	2022-03-12
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects…
CVE-2019-11358US	medium6.1	86.8% (100th)	Exploit	2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob…
CVE-2020-7774US	critical9.8	69.4% (99th)	—	2020-11-17
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

+703 weitere

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan