CVE-2022-41713

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-417145.3fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the applica CVE-2022-417157.5Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed re CVE-2022-417167.5Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exe CVE-2022-417175.3An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP he CVE-2022-417197.5Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.CVE-2022-41726.5An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_ers CVE-2022-417207.5On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of CVE-2022-417217.5A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully cons CVE-2022-417227.5A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path CVE-2022-417237.5A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from CVE-2022-417247.5Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers an CVE-2022-417257.5A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipa