gsd-2022-39353
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-39353",
"description": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.",
"id": "GSD-2022-39353"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-39353"
],
"details": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.",
"id": "GSD-2022-39353",
"modified": "2023-12-13T01:19:20.925534Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39353",
"STATE": "PUBLIC",
"TITLE": "xmldom allows multiple root nodes in a DOM"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "xmldom",
"version": {
"version_data": [
{
"version_value": "\u003c= 0.6.0"
},
{
"version_value": "\u003c 0.7.7"
},
{
"version_value": "\u003e= 0.8.0, \u003c 0.8.4"
},
{
"version_value": "\u003e= 0.9.0-beta.1, \u003c 0.9.0-beta.4"
}
]
}
}
]
},
"vendor_name": "xmldom"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20: Improper Input Validation"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1288: Improper Validation of Consistency within Input"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"refsource": "CONFIRM",
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
},
{
"name": "https://github.com/jindw/xmldom/issues/150",
"refsource": "MISC",
"url": "https://github.com/jindw/xmldom/issues/150"
},
{
"name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
}
]
},
"source": {
"advisory": "GHSA-crh6-fp67-6883",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c0.7.7||\u003e=0.8.0 \u003c0.8.4||=0.9.0",
"affected_versions": "All versions before 0.7.7, all versions starting from 0.8.0 before 0.8.4, version 0.9.0",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-20",
"CWE-937"
],
"date": "2023-03-01",
"description": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.",
"fixed_versions": [
"0.7.7",
"0.8.4"
],
"identifier": "CVE-2022-39353",
"identifiers": [
"CVE-2022-39353",
"GHSA-crh6-fp67-6883",
"GMS-2022-6112"
],
"not_impacted": "All versions starting from 0.7.7 before 0.8.0, all versions starting from 0.8.4 before 0.9.0, all versions after 0.9.0",
"package_slug": "npm/@xmldom/xmldom",
"pubdate": "2022-11-02",
"solution": "Upgrade to versions 0.7.7, 0.8.4 or above.",
"title": "Improper Input Validation",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-39353",
"https://github.com/jindw/xmldom/issues/150",
"https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"https://github.com/xmldom/xmldom/releases/tag/0.7.7",
"https://github.com/xmldom/xmldom/releases/tag/0.8.4",
"https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4",
"https://github.com/advisories/GHSA-crh6-fp67-6883"
],
"uuid": "4eded5e6-9003-4b73-a449-46915611bf09"
},
{
"affected_range": "\u003c0",
"affected_versions": "All versions before 0.7.7, all versions starting from 0.8.0 before 0.8.4, all versions starting from 0.9.0-beta.1 before 0.9.0-beta.4",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2022-11-01",
"description": "### Impact\nxmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.\nThis breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.\n\n### Patches\nUpdate to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@\u003e=0.9.0-beta.4` (dist-tag `next`).\n\n### Workarounds\nOne of the following approaches might help, depending on your use case:\n- Instead of searching for elements in the whole DOM, only search in the `documentElement`.\n- Reject a document with a document that has more then 1 `childNode`.\n\n### References\n- https://nvd.nist.gov/vuln/detail/CVE-2022-39299\n- https://github.com/jindw/xmldom/issues/150\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@xmldom.org\n",
"fixed_versions": [
"0.7.7",
"0.8.4",
"0.9.0-beta.4"
],
"identifier": "GMS-2022-6112",
"identifiers": [
"GHSA-crh6-fp67-6883",
"GMS-2022-6112",
"CVE-2022-39353"
],
"not_impacted": "All versions starting from 0.7.7 before 0.8.0, all versions starting from 0.8.4 before 0.9.0-beta.1, all versions starting from 0.9.0-beta.4",
"package_slug": "npm/@xmldom/xmldom",
"pubdate": "2022-11-01",
"solution": "Upgrade to versions 0.7.7, 0.8.4, 0.9.0-beta.4 or above. *Note*: 0.9.0-beta.4 may be an unstable version. Use caution.",
"title": "Duplicate of ./npm/@xmldom/xmldom/CVE-2022-39353.yml",
"urls": [
"https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"https://github.com/xmldom/xmldom/releases/tag/0.7.7",
"https://github.com/xmldom/xmldom/releases/tag/0.8.4",
"https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4",
"https://github.com/advisories/GHSA-crh6-fp67-6883"
],
"uuid": "ec504658-1583-4721-b861-2fb17766b62f"
},
{
"affected_range": "\u003c0.7.7||\u003e=0.8.0 \u003c0.8.4||=0.9.0",
"affected_versions": "All versions before 0.7.7, all versions starting from 0.8.0 before 0.8.4, version 0.9.0",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-20",
"CWE-937"
],
"date": "2023-03-01",
"description": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.",
"fixed_versions": [],
"identifier": "CVE-2022-39353",
"identifiers": [
"CVE-2022-39353",
"GHSA-crh6-fp67-6883",
"GMS-2022-6132"
],
"not_impacted": "",
"package_slug": "npm/xmldom",
"pubdate": "2022-11-02",
"solution": "Unfortunately, there is no solution available yet.",
"title": "Improper Input Validation",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2022-39353",
"https://github.com/jindw/xmldom/issues/150",
"https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"https://github.com/xmldom/xmldom/releases/tag/0.7.7",
"https://github.com/xmldom/xmldom/releases/tag/0.8.4",
"https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4",
"https://github.com/advisories/GHSA-crh6-fp67-6883"
],
"uuid": "416e8df8-4360-4621-b800-f47e3dca7bb3"
},
{
"affected_range": "\u003c0",
"affected_versions": "All versions up to 0.6.0",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2022-11-01",
"description": "### Impact\nxmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.\nThis breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.\n\n### Patches\nUpdate to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@\u003e=0.9.0-beta.4` (dist-tag `next`).\n\n### Workarounds\nOne of the following approaches might help, depending on your use case:\n- Instead of searching for elements in the whole DOM, only search in the `documentElement`.\n- Reject a document with a document that has more then 1 `childNode`.\n\n### References\n- https://nvd.nist.gov/vuln/detail/CVE-2022-39299\n- https://github.com/jindw/xmldom/issues/150\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@xmldom.org\n",
"fixed_versions": [],
"identifier": "GMS-2022-6132",
"identifiers": [
"GHSA-crh6-fp67-6883",
"GMS-2022-6132",
"CVE-2022-39353"
],
"not_impacted": "",
"package_slug": "npm/xmldom",
"pubdate": "2022-11-01",
"solution": "Unfortunately, there is no solution available yet.",
"title": "Duplicate of ./npm/xmldom/CVE-2022-39353.yml",
"urls": [
"https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"https://github.com/xmldom/xmldom/releases/tag/0.7.7",
"https://github.com/xmldom/xmldom/releases/tag/0.8.4",
"https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4",
"https://github.com/advisories/GHSA-crh6-fp67-6883"
],
"uuid": "c2d708fe-d1a0-4aef-b3a1-a63c421cd5f0"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta1:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndExcluding": "0.6.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndExcluding": "0.8.4",
"versionStartIncluding": "0.8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta2:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta3:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndExcluding": "0.7.7",
"versionStartIncluding": "0.7.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-39353"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-1288"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jindw/xmldom/issues/150",
"refsource": "MISC",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/jindw/xmldom/issues/150"
},
{
"name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
},
{
"name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-03-01T14:03Z",
"publishedDate": "2022-11-02T17:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.