CVE-2022-0144 - Improper Privilege Management (IPM)

Abstract

The shelljs package is vulnerable due to Improper Privilege Management. The execSync() function in the exec.js file does not properly ensure if a user is authorized to read and write to the paramFiles, stdoutFile and stderrFile before allowing the user to access them. A local attacker with low privileges can exploit this behavior to obtain sensitive information from the aforementioned files. The attacker can also create a stdoutFile or stderrFile first, which will crash the exec process when it tries to write to these files, resulting in a Denial of Service (DoS) condition.

The Oxygen Content Fusion product incorporates shelljs as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2022-0144

Severity: High

CVSS Score: 7.1

The shelljs third-party library used by Oxygen Content Fusion product is an affected version mentioned in CVE-2022-0144 vulnerability description. However, the shelljs library is used only for backup restore and it is executed into an isolated container that is not available to untrusted users. For that reason, we have rated the severity level for our products as low.