CVE-2022-32222: Medium severity ibm cognos controller vulnerability
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
Other sources
Node.js could allow a remote attacker to bypass security restrictions. By attempting to read openssl.cnf from /home/iojs/build/ upon startup, an attacker could exploit this vulnerability to create this file and affect the default OpenSSL configuration for other users.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-32222?
CVE-2022-32222 is a cryptographic vulnerability in Node.js on Linux in versions of 18.x prior to 18.40.0.
What is the severity of CVE-2022-32222?
The severity of CVE-2022-32222 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2022-32222?
Node.js versions 18.x prior to 18.40.0 on Linux are affected by CVE-2022-32222.
What is the reference for CVE-2022-32222?
The reference for CVE-2022-32222 is https://hackerone.com/reports/1695596.
What is the CWE of CVE-2022-32222?
The CWE of CVE-2022-32222 is CWE-427 and CWE-310.