Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
History

Mon, 28 Apr 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Wed, 23 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

Mon, 19 Aug 2024 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.4::el8
cpe:/a:redhat:acm:2.5::el8

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-04-04T00:00:00.000Z

Updated: 2025-04-23T18:42:13.669Z

Reserved: 2022-02-10T00:00:00.000Z

Link: CVE-2022-24785

cve-icon Vulnrichment

Updated: 2024-08-03T04:20:50.533Z

cve-icon NVD

Status : Modified

Published: 2022-04-04T17:15:07.583

Modified: 2024-11-21T06:51:05.483

Link: CVE-2022-24785

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-04-04T00:00:00Z

Links: CVE-2022-24785 - Bugzilla