CVE-2022-23923: Sandbox Bypass
Node.js jailed module could allow a remote attacker to bypass security restrictions, caused by a flaw in the Node.js jailed module. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform sandbox bypass to access the main application.
Other sources
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23923?
CVE-2022-23923 has been classified with a high severity due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2022-23923?
To remediate CVE-2022-23923, it is recommended to update the Jailed module to the latest version where this vulnerability is patched.
Which software is affected by CVE-2022-23923?
CVE-2022-23923 affects the Jailed module in Node.js and IBM Planning Analytics versions up to 2.0.
What type of attacks can CVE-2022-23923 enable?
CVE-2022-23923 can enable sandbox bypass attacks, allowing attackers to access the main application.
Is CVE-2022-23923 present in all versions of the affected software?
CVE-2022-23923 impacts all versions of the Jailed module and IBM Planning Analytics up to version 2.0.