CVE-2022-41940
Assigner: GitHub_M
Published: 2022-11-22T00:00:00
State: PUBLISHED
title: Uncaught exception in engine.io 
descriptions: value: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
affected: vendor: socketio
product: engine.io
versions: version: < 3.6.1
status: affected
version: >= 4.0.0, < 6.2.1
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-248: Uncaught Exception
cweId: CWE-248
source: advisory: GHSA-r7qp-cfhv-p84w
discovery: UNKNOWN