Vulnerabilities > CVE-2022-2421 - Unspecified vulnerability in Socket Socket.Io-Parser

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

socket

critical

NVD

Published: 2022-10-26

Updated: 2024-01-02

Summary

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Vulnerable Configurations

Part	Description	Count
Application	Socket Socket Socket.Io Parser 4.1.0 Socket Socket.Io Parser 4.1.1 Socket Socket.Io Parser 4.1.2 Socket Socket.Io Parser 4.2.0 Socket Socket.Io Parser 2.0.0 Socket Socket.Io Parser 2.1.0 Socket Socket.Io Parser 2.1.1 Socket Socket.Io Parser 2.1.2 Socket Socket.Io Parser 2.1.3 Socket Socket.Io Parser 2.1.4 Socket Socket.Io Parser 2.1.5 Socket Socket.Io Parser 2.2.0 Socket Socket.Io Parser 2.2.1 Socket Socket.Io Parser 2.2.2 Socket Socket.Io Parser 2.2.3 Socket Socket.Io Parser 2.2.4 Socket Socket.Io Parser 2.2.5 Socket Socket.Io Parser 2.2.6 Socket Socket.Io Parser 2.3.0 Socket Socket.Io Parser 2.3.1 Socket Socket.Io Parser 2.3.2 Socket Socket.Io Parser 3.0.0 Socket Socket.Io Parser 3.1.0 Socket Socket.Io Parser 3.1.1 Socket Socket.Io Parser 3.1.2 Socket Socket.Io Parser 3.1.3 Socket Socket.Io Parser 3.2.0 Socket Socket.Io Parser 3.3.0 Socket Socket.Io Parser 3.3.1 Socket Socket.Io Parser 3.4.0 Socket Socket.Io Parser 3.4.1 Socket Socket.Io Parser 3.4.2 Socket Socket.Io Parser 3.4.3 Socket Socket.Io Parser 4.0.0 Socket Socket.Io Parser 4.0.1 Socket Socket.Io Parser 4.0.2 Socket Socket.Io Parser 4.0.3 Socket Socket.Io Parser 4.0.4	41

Summary

Vulnerable Configurations

References