p PatchFirst

CVE-2022-24785

CVE-2022-24785 · Path Traversal in Moment.js

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVSS 7.5 · High · EPSS 13.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • moment

    Versions
    • >= 1.0.1, < 2.29.2: Affected

    No fix published

  • node-moment Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.29.2+ds-1

    Update to 2.29.2+ds-1

  • node-moment Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.29.2+ds-1

    Update to 2.29.2+ds-1

  • node-moment Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.29.2+ds-1

    Update to 2.29.2+ds-1

  • moment npm

    Affected ranges
    • SEMVER: < 2.29.2

    Update to 2.29.2

  • moment.js NuGet

    Versions
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 2.0.0
    • 2.1.0
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.10.5
    • 2.10.6
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.12.0
    • 2.13.0
    • 2.14.1
    • 2.14.2
    • 2.14.3
    • 2.15.0
    • 2.15.1
    • 2.15.2
    • 2.16.0
    • 2.17.0
    • 2.17.1
    • 2.18.0
    • 2.18.1
    • 2.18.2
    • 2.19.0
    • 2.19.1
    • 2.19.2
    • 2.19.3
    • 2.19.4
    • 2.2.0
    • 2.2.1
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.22.0
    • 2.22.1
    • 2.22.2
    • 2.23.0
    • 2.24.0
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.26.0
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.29.1
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.7.0
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.8.4
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.29.2

    Update to 2.29.2

  • nikola Ubuntu:16.04:LTS

    Versions
    • 7.6.0-3
    • 7.6.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:Pro:16.04:LTS

    Versions
    • 2.10.6+dfsg-1
    • 2.11.0+ds-1
    • 2.11.0+ds-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:18.04:LTS

    Versions
    • 2.18.1+ds-1
    • 2.19.1+ds-1
    • 2.19.2+ds-1
    • 2.19.3+ds-1
    • 2.19.4+ds-1
    • 2.20.1+ds-1
    Affected ranges
    • ECOSYSTEM: < 2.20.1+ds-1ubuntu0.1

    Update to 2.20.1+ds-1ubuntu0.1

  • node-moment Ubuntu:20.04:LTS

    Versions
    • 2.24.0+ds-1
    • 2.24.0+ds-2
    Affected ranges
    • ECOSYSTEM: < 2.24.0+ds-2ubuntu0.1

    Update to 2.24.0+ds-2ubuntu0.1

  • node-moment Ubuntu:22.04:LTS

    Versions
    • 2.29.1+ds-2
    • 2.29.1+ds-3
    Affected ranges
    • ECOSYSTEM: < 2.29.1+ds-3ubuntu0.2

    Update to 2.29.1+ds-3ubuntu0.2

Original sources

Check your server →