CVE-2022-25948
Assigner: snyk
Published: 2022-12-22T00:00:00
State: PUBLISHED
title: Information Exposure
datePublic: 2022-12-22T00:00:00
descriptions: value: The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
affected: vendor: n/a
product: liquidjs
versions: version: unspecified
lessThan: 10.0.0
status: affected
versionType: custom
credits: value: amit777
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Information Exposure