Quick answers
- Is CVE-2022-38545 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-38545 being exploited in the wild.
- How severe is CVE-2022-38545?
- Low severity, with a CVSS score of 3.1, published 20 September 2022.
- Which products and versions are affected?
- valine (npm) SEMVER:introduced=0,fixed=1.5.0.
- Is there a fix for CVE-2022-38545?
- Yes. valine (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-38545 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-38545?
- Check whether you run valine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- valine (npm): upgrade to 1.5.0 or later
npm install valine@1.5.0
Technical details
Valine contains a code injection vulnerability (CWE-74, CWE-79) that allows remote code execution through a crafted POST request. The vulnerability stems from insufficient input sanitization of user-supplied data, particularly in the user-agent field of comments, which can be manipulated to execute arbitrary code. An attacker requires network access to the affected Valine instance but no authentication; user interaction may be required depending on deployment context. The vulnerability affects all versions prior to 1.5.0, which includes the fix. The vulnerability was publicly disclosed in June 2022 with patches available since then.
Affected products
- Valine Valine All versions prior to 1.5.0
Identifiers
- CVE-2022-38545
- GHSA-mcvg-g9wx-v5vx
Timeline
- 2022-06-21: disclosed: Issue reported on GitHub
- 2022-09-20: advisory: GHSA advisory published
- 2022-09-20: patched: Fix released in version 1.5.0