CVE-2022-32222

MEDIUM

Node.js 18.x < 18.40.0 - Cryptographic Configuration Path Vulnerability

Title source: llm

Description

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

References (1)

Core 1

Core References

Exploit

https://hackerone.com/reports/1695596

Scores

CVSS v3 5.3

EPSS 0.0062

EPSS Percentile 70.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE

CWE-310 CWE-427

Status published

Products (3)

nodejs/node.js 18.0.0 - 18.5.0

siemens/sinec_ins 1.0 (3 CPE variants)

siemens/sinec_ins < 1.0

Published Jul 14, 2022

Tracked Since Feb 18, 2026