p PatchFirst

CVE-2022-39357

CVE-2022-39357 · Winter vulnerable to Prototype Pollution in Snowboard framework

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

CVSS 8.1 · High · EPSS 1.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • winter

    Versions
    • >= 1.1.8, < 1.1.10: Affected
    • = 1.2.0: Affected

    No fix published

  • wintercms/winter Packagist

    Versions
    • v1.1.8
    • v1.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.1.8, < 1.1.10

    Update to 1.1.10

  • wintercms/winter Packagist

    Versions
    • v1.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.1

    Update to 1.2.1

Original sources

Check your server →