CVE-2022-24785

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Database specific

{
    "cwe_ids": [
        "CWE-22",
        "CWE-27"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24785.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/moment/moment

Affected ranges

Type

GIT

Repo

https://github.com/moment/moment

Events

Introduced

a0c5b6e599835acc37f9eeb143a2fba1043ac244

Fixed

75e2ac573e8cd62086a6bc6dc1b8d271e2804391

Fixed

4211bfc8f15746be4019bba557e29a7ba83d54c5

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*",
        "cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.1"
        },
        {
            "fixed": "2.29.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.1

1.1.0

1.1.1

1.1.2

1.2.0

1.3.0

1.4.0

1.5.0

1.7.1

2.*

2.1.0

2.10.2

2.10.3

2.10.5

2.10.6

2.11.0

2.11.1

2.11.2

2.12.0

2.13.0

2.14.0

2.14.1

2.15.0

2.15.1

2.15.2

2.16.0

2.17.0

2.17.1

2.18.0

2.18.1

2.19.0

2.19.1

2.19.2

2.19.3

2.19.4

2.2.0

2.2.1

2.20.0

2.20.1

2.21.0

2.22.0

2.22.1

2.22.2

2.23.0

2.24.0

2.25.0

2.25.1

2.25.2

2.25.3

2.26.0

2.27.0

2.28.0

2.29.0

2.29.1

2.3.0

2.3.1

2.4.0

2.5.0

2.5.1

2.6.0

2.7.0

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24785.json"