CVE-2022-1650: debian debian_linux
CVSS: 9.3v3.1CriticalModified
AliasesRHBA-2022:5721RHBA-2022:5747RHBA-2022:5749UBUNTU-CVE-2022-1650USN-6082-1DEBIAN-CVE-2022-1650DLA-3235-1GHSA-6h5x-7c5m-7cr7
Published 12-05-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-1650 is a critical (CVSS 9.3) vulnerability in debian debian_linux. EPSS estimates a 1.86% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.3/10
010
Critical · v3.1 (NVD)EPSS score
1.86%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 12-05-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
CVSS metrics
7 scores · 6 sources · 2 versionsCritical 9.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NSources6 sources · 8.1–9.3
- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- OSV · NpmEcosystem advisory · calculated9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.86%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.01 pp
From 1.85% on 21-09-2026
21-09-202621-10-2026
EPSS score1.86%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat33 products
- aspnetcore-runtime-6.0< 0:6.0.7-1.el8_6 | < 0:6.0.7-1.el9_0
- aspnetcore-targeting-pack-6.0< 0:6.0.7-1.el8_6 | < 0:6.0.7-1.el9_0
- dotnet< 0:6.0.107-1.el8_6
- dotnet-apphost-pack-6.0< 0:6.0.7-1.el8_6 | < 0:6.0.7-1.el9_0
- dotnet-apphost-pack-6.0-debuginfo< 0:6.0.7-1.el8_6 | < 0:6.0.7-1.el9_0
Debian2 products
- node-eventsource< 0.2.1-1+deb10u1 | < 2.0.2+~1.1.8-1
- debian_linuxEOL10.0
Eventsource2 products
- eventsource< 1.1.1 | ≥ 2.0.0, < 2.0.2
- eventsource/eventsource≥ v2.0.0, < unspecified | ≥ unspecified, < v2.0.2 | ≥ unspecified, ≤ v1.1.0
Npm1 product
- eventsource< 1.1.1 | ≥ 2.0.0, < 2.0.2
Ubuntu1 product
- node-eventsource< 0.1.6-1ubuntu0.1~esm1 | < 0.2.1-1+deb10u1build0.18.04.1 | < 0.2.1-1+deb10u1build0.20.04.1 | < 1.1.0+~1.1.8-1ubuntu0.1
5 vendors · 39 products
References
20 links- huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8eARTICLEREPORTWEBExploitIssue TrackingPatchThird Party Advisory
- github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4REPORTWEBPatchThird Party Advisory
