CVE-2022-21824
mediumpriority · track · 41EPSS 0.215 · 98 %ileDEEURUUSEPSS · scored 2026-10-26
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedfesto_psirt
FactoryViews (non-Lite): Upgrade to FactoryViews 1.6.0. See the upgrade guide for information on how to upgrade. FactoryViews Lite: Upgrade to FactoryViews 1.7.0. See the upgrade guide for information on how to upgrade.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.7–8.2
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (65)
Products and version ranges known to be affected.
- FactoryViews 1.6.0all versionsfixedfesto_psirtDEcpe:2.3:a:festo:factory_views_software:1.6.0:*:*:*:*:*:*:*
- FactoryViews 1.7.0all versionsfixedfesto_psirtDEcpe:2.3:a:festo:factory_views_software:1.7.0:*:*:*:*:*:*:*
advisories (11)
Vendor and ecosystem advisories describing this.
- FSA-202302Festo: Several vulnerabilities in FactoryViews2023-07-10csaf · festo_psirtDE
FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications. FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities. At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.
- WID-SEC-W-2022-0099Node.js: Mehrere SchwachstellenDeutsch2022-01-10csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Dateien zu manipulieren.
- WID-SEC-W-2022-0302Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2022-06-14csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.
- WID-SEC-W-2022-0432Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2022-06-21csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
- WID-SEC-W-2022-0735Oracle MySQL: Mehrere SchwachstellenDeutsch2022-07-19csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-0137Oracle Communications: Mehrere SchwachstellenDeutsch2023-01-17csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1034Oracle JD Edwards: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1542Red Hat OpenShift: Mehrere SchwachstellenDeutsch2023-06-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-2471IBM Spectrum Protect Plus: Mehrere SchwachstellenDeutsch2022-01-31csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.
- BIT-node-2022-218242024-03-06vendor · osvUS
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
- BIT-node-min-2022-218242024-12-16vendor · osvUS
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202201-726cnnvd
- EUVD-2022-26983enisa_euvd
- BDU:2022-00760fstec_bdu
- GHSA-39wv-qjgj-4jxgenisa_euvd
- BIT-node-2022-21824osv
- BIT-node-min-2022-21824osv
sources
Which sources assert this record, and when.
references (41)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-21824/cnnvd
- https://hackerone.com/reports/1431042cnnvd
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlcnnvd
- https://nodejs.org/en/Patchcnnvd
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/cnnvd
- https://packetstormsecurity.com/files/167418/Red-Hat-Security-Advisory-2022-4914-01.htmlcnnvd
- https://packetstormsecurity.com/files/169437/Red-Hat-Security-Advisory-2022-7044-01.htmlcnnvd
- https://packetstormsecurity.com/files/169781/Red-Hat-Security-Advisory-2022-7830-01.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan