NetSight
IP …
high8.2

CVE-2022-21824

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while s…

Impact

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Affected products

VendorProductAffected versions
NodejsNode.Js
from 12.0.0 before 12.22.9
from 14.0.0 before 14.18.3
from 16.0.0 before 16.13.2
from 17.0.0 before 17.3.1
OracleMysql Cluster
through 8.0.29
OracleMysql Connectors
through 8.0.28
OracleMysql Enterprise Monitor
through 8.0.29
OracleMysql Server
through 8.0.29
OracleMysql Workbench
through 8.0.28
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59
DebianDebian Linux
Versions 10.0, 11.0
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
NetappSnapcenter
All versions

Weakness classification

CWE-471CWE-1321

References