CVE-2022-23623 Validation bypass in frourio
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-23623?
CVE-2022-23623 is a high-severity vulnerability in frouriojs frourio, published on 7 Feb 2022.
Official description
Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.
Which versions are affected by CVE-2022-23623?
2 open source packages ship an affected version, including frourio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
frourio npm | All versions | 0.26.0 |
frourio npm | All versions | 0.26.0 |
Products include Frourio Frourio.
How do I fix CVE-2022-23623?
Upgrade frourio to 0.26.0 or later.
Is CVE-2022-23623 being exploited?
There is no known exploitation of CVE-2022-23623 in the wild and no public exploit code.
Sources
Also known as GHSA-8xxm-h73r-ghfj.