CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Database specific

{
    "cwe_ids": [
        "CWE-22",
        "CWE-27"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24785.json"
}

References

Affected packages

Git / github.com/moment/moment

Affected ranges

Type: GIT
Repo: https://github.com/moment/moment
Events: Introduced

a0c5b6e599835acc37f9eeb143a2fba1043ac244

Fixed

75e2ac573e8cd62086a6bc6dc1b8d271e2804391

Affected versions

1.*

1.0.1

1.1.0

1.1.1

1.1.2

1.2.0

1.3.0

1.4.0

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.7.2

2.*

2.0.0

2.1.0

2.10.2

2.10.3

2.10.5

2.10.6

2.11.0

2.11.1

2.11.2

2.12.0

2.13.0

2.14.0

2.14.1

2.15.0

2.15.1

2.15.2

2.16.0

2.17.0

2.17.1

2.18.0

2.18.1

2.19.0

2.19.1

2.19.2

2.19.3

2.19.4

2.2.0

2.2.1

2.20.0

2.20.1

2.21.0

2.22.0

2.22.1

2.22.2

2.23.0

2.24.0

2.25.0

2.25.1

2.25.2

2.25.3

2.26.0

2.27.0

2.28.0

2.29.0

2.29.1

2.3.0

2.3.1

2.4.0

2.5.0

2.5.1

2.6.0

2.7.0

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.9.0