CVE-2022-24785 @ Npm-moment-2.24.0

[CMaheshBL]

Vulnerable Package issue exists @ Npm-moment-2.24.0 in branch master

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Namespace: CMaheshBL
Repository: NodeGoat
Repository Url: https://github.com/CMaheshBL/NodeGoat
CxAST-Project: CMaheshBL/NodeGoat
CxAST platform scan: d7c1c0af-6b2d-455e-8753-a6b87dbf733d
Branch: master
Application: NodeGoat
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-22

---

Addition Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: NONE
Remediation Upgrade Recommendation: 2.29.2

---

References
Advisory
Commit
Release Note