CVE-2022-26183

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefb	Patch
https://github.com/pnpm/pnpm/releases/tag/v6.15.1	Release Notes
https://www.sonarsource.com/blog/securing-developer-tools-package-managers/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-21 22:15

Updated : 2023-11-09 20:55

NVD link : CVE-2022-26183

Mitre link : CVE-2022-26183

CVE.ORG link : CVE-2022-26183

JSON object : View

Products Affected

microsoft

windows

pnpm

pnpm

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2022-26183", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-03-21T22:15:07.987", "references": [{"url": "https://github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefb", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/pnpm/pnpm/releases/tag/v6.15.1", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.sonarsource.com/blog/securing-developer-tools-package-managers/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS."}, {"lang": "es", "value": "Se ha detectado que PNPM versi\u00f3n v6.15.1 y anteriores, contiene una ruta de b\u00fasqueda no confiable que causa a la aplicaci\u00f3n comportarse de manera no esperada cuando usuarios ejecutan comandos de PNPM en un directorio que contiene contenido malicioso. Esta vulnerabilidad es producida cuando la aplicaci\u00f3n es ejecutada en el Sistema Operativo Windows"}], "lastModified": "2023-11-09T20:55:05.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9B897CD0-4634-457B-B9C4-49B71072636F", "versionEndExcluding": "6.15.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}