This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a
    nested JSON representation of the configuration. The .set() function, that is responsible for setting the
    configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is
    possible to modify the properties on the Object.prototype. (CVE-2022-21803)

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template     injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and     overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template     compilation). (CVE-2022-29078)

  - The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address     string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control     that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
    (CVE-2021-29418)

  - Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated     remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A     remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical     VPN or LAN hosts. (CVE-2021-28918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
411719	SCA: security update for nconf (GHSA-6xwr-q98w-rvg7)	Tenable Cloud Security	SCA Checks	high
411719	SCA: security update for nconf (GHSA-6xwr-q98w-rvg7)	Tenable Self-Hosted Container Security	SCA Checks	high
164652	IBM Cognos Analytics Multiple Vulnerabilities (6616285)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2022-21803

high

Tenable Plugins

high

high

critical