CVE-2022-39357

 

Published at: - 26-10-2022 05:15

Last modified: - 26-10-2022 05:15

Total changes: - 1

Description

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/wintercms/winter/releases/tag/v1.2.1
• https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1
• https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f
• https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q
• https://github.com/wintercms/winter/releases/tag/v1.1.10

 

Keywords

NVD

 

CVE-2022-39357

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures