CVE-2022-32222

Published: Jul 14, 2022Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

Affected (5)

Products: Nodejs: Node.js · Siemens: Sinec Ins

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 18.0.0 to 18.5.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinec Ins	Before 1.0
Siemens Sinec Ins	Version 1.0
Siemens Sinec Ins	Version 1.0 sp1
Siemens Sinec Ins	Version 1.0 sp2

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (2)

https://hackerone.com/reports/1695596

Source: support@hackerone.com

Exploit

https://hackerone.com/reports/1695596

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.