Vulnerability Details : CVE-2022-39357
Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.
Products affected by CVE-2022-39357
- cpe:2.3:a:wintercms:winter:1.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:wintercms:winter:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wintercms:winter:1.1.8:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-39357
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-39357
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
GitHub, Inc. |
CWE ids for CVE-2022-39357
-
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.Assigned by:
- nvd@nist.gov (Primary)
- security-advisories@github.com (Secondary)
References for CVE-2022-39357
-
https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q
Prototype pollution in Snowboard framework · Advisory · wintercms/winter · GitHubPatch;Third Party Advisory
-
https://github.com/wintercms/winter/releases/tag/v1.2.1
Release v1.2.1 · wintercms/winter · GitHubRelease Notes;Third Party Advisory
-
https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1
Harden Snowboard (#687) · wintercms/winter@2a13faf · GitHubPatch;Third Party Advisory
-
https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f
Harden Snowboard (#687) · wintercms/winter@bce4b59 · GitHubPatch;Third Party Advisory
-
https://github.com/wintercms/winter/releases/tag/v1.1.10
Release v1.1.10 · wintercms/winter · GitHubRelease Notes;Third Party Advisory
Jump to