CVE-2022-32222

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-32222
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://hackerone.com/reports/1695596 Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*
History

24 Jul 2023, 13:16

Type Values Removed Values Added
References (MISC) https://hackerone.com/reports/1695596 - (MISC) https://hackerone.com/reports/1695596 - Exploit
CWE CWE-326 CWE-427

23 Feb 2023, 20:15

Type Values Removed Values Added
Summary A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.4.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
References
  • {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf', 'name': 'https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'CONFIRM'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20220915-0001/', 'name': 'https://security.netapp.com/advisory/ntap-20220915-0001/', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • {'url': 'https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/', 'name': 'https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://hackerone.com/reports/1695596 -

23 Feb 2023, 16:44

Type Values Removed Values Added
First Time Siemens sinec Ins
Siemens
CPE cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - Patch, Third Party Advisory

23 Jan 2023, 16:15

Type Values Removed Values Added
Summary A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.4.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

10 Jan 2023, 13:15

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf -

27 Oct 2022, 16:38

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0001/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0001/ - Third Party Advisory

15 Sep 2022, 18:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220915-0001/ -

21 Jul 2022, 16:13

Type Values Removed Values Added
References (MISC) https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - (MISC) https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - Patch, Vendor Advisory
CWE CWE-326
CPE cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
First Time Nodejs
Nodejs node.js
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

14 Jul 2022, 15:19

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-14 15:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-32222

Mitre link : CVE-2022-32222

CVE.ORG link : CVE-2022-32222

JSON object : View

Products Affected

nodejs

  • node.js

siemens

  • sinec_ins
CWE
CWE-427

Uncontrolled Search Path Element

CWE-310

Cryptographic Issues