Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-24785
CVE-2022-24785:
JavaScript vulnerability analysis and mitigation
Overview
A path traversal vulnerability (CVE-2022-24785) was discovered in Moment.js, a JavaScript date library for parsing, validating, manipulating, and formatting dates. The vulnerability affects versions between 1.0.1 and 2.29.1, particularly impacting npm (server) users when a user-provided locale string is directly used to switch moment locale. The issue was patched in version 2.29.2 (GitHub Advisory, NVD).
Technical details
The vulnerability is classified as a path traversal issue (CWE-22, CWE-27) with a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The issue occurs when handling user-provided locale strings, where insufficient validation could allow an attacker to traverse directories through the locale parameter (GitHub Advisory).
Impact
Successful exploitation of this vulnerability could lead to addition or modification of data through path traversal. The vulnerability allows attackers to potentially access or modify files outside the intended directory structure when processing locale strings (NetApp Advisory).
Mitigation and workarounds
The primary mitigation is to upgrade to Moment.js version 2.29.2 which contains the fix for this vulnerability. As a workaround, if upgrading is not immediately possible, users should sanitize any user-provided locale name before passing it to Moment.js (GitHub Advisory, Debian Advisory).
Community reactions
Multiple organizations and vendors responded to this vulnerability by releasing security advisories and patches, including NetApp, Tenable, and various Linux distributions. Debian included this fix in their security updates, and Fedora released updated packages to address the vulnerability (Debian Advisory, Fedora Update).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management