CVE-2022-24785
High
Description
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Moment
PublishedApr 4, 2022
First seenApr 4, 2022
Weakness typeCWE-22Path traversalCWE-27CWE-27
How to fix
Update
- momentjs moment2.29.2 or later
- tenable tenable.sc5.21.0 or later
- moment2.29.2 or later
- Moment.js2.29.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| momentjs moment | 1.0.1 ≤ v < 2.29.2 | 2.29.2 |
| tenable tenable.sc | v < 5.21.0 | 5.21.0 |
| netapp active_iq | No range specified | — |
| fedoraproject fedora | 35, 36 | — |
| debian debian_linux | 10.0 | — |
| momentnpm | v < 2.29.2 | 2.29.2 |
| Moment.jsNuGet | v < 2.29.2 | 2.29.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.