CVE-2022-2421 - Remote Code Execution (RCE)

Abstract

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

The Oxygen products incorporate Socket.io as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2022-2421

Severity: Critical

CVSS Score: 9.8

The Socket.io third-party library used by Oxygen XML products is an affected version mentioned in CVE-2022-2421 vulnerability description.