Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-25912
CVE-2022-25912:
JavaScript vulnerability analysis and mitigation
Overview
The simple-git package versions before 3.15.0 contain a Remote Code Execution (RCE) vulnerability identified as CVE-2022-25912. This vulnerability is exploitable when enabling the ext transport protocol through the clone() method. The issue emerged as a result of an incomplete fix for a previous vulnerability (CVE-2022-24066) and was disclosed on November 10, 2022 (Snyk JS).
Technical details
The vulnerability allows remote code execution through improper input sanitization when using the ext transport protocol. The vulnerability has a CVSS base score of 8.1 (High) according to Snyk's assessment, with Network attack vector, High attack complexity, and No privileges required. The vulnerability affects the package's core functionality related to git command execution (Snyk JS).
Impact
If exploited, this vulnerability can lead to a total loss of confidentiality, integrity, and availability of the affected system. An attacker can potentially execute arbitrary commands on the target system, leading to complete system compromise. The vulnerability presents direct, serious consequences to the impacted component (Snyk JS).
Mitigation and workarounds
The recommended mitigation is to upgrade simple-git to version 3.15.0 or higher. The fix includes disabling the use of inline configuration arguments to prevent unintentionally allowing non-standard remote protocols without explicitly opting in through the new allowUnsafeProtocolOverride property (GitHub Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management