CVE-2022-23395
Prototype Pollution in jquery.cookie
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
CVE-2022-23395- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List No score
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
CVE-2022-23395- Updated
- 2026-11-02
EUVDEUVD-2022-1424 No score
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
EUVD-2022-1424- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gcx5-3p5f-f8vp
Prototype Pollution in jquery.cookie
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
GHSA-gcx5-3p5f-f8vp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-23395
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
DEBIAN-CVE-2022-23395- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSVGHSA-gcx5-3p5f-f8vp
Prototype Pollution in jquery.cookie
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
GHSA-gcx5-3p5f-f8vp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV No score
jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
- Record
CVE-2022-23395- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquery.cookieNuGet |
through 1.4.1 | None known |
jquery-goodiesDebian:12 |
All versions, plus listed versions 12-4 |
None known |
jquery-goodiesDebian:13 |
All versions, plus listed versions 12-4 |
None known |
jquery-goodiesDebian:14 |
All versions, plus listed versions 12-4 |
None known |
jquery.cookieNuGet |
through 1.4.1, plus listed versions 1.0.01.3.11.4.0 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23395 is a medium vulnerability (CVSS 6.1) in Jquery.cookie Project Jquery.cookie, published March 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. No source names a fixed version.
References
snyk.io/test/npm/jquery.cookie/1.4.1?tab=issues
security.netapp.com/advisory/ntap-20220325-0008
nvd.nist.gov/vuln/detail/CVE-2022-23395
github.com/advisories/GHSA-gcx5-3p5f-f8vp
security-tracker.debian.org/tracker/CVE-2022-23395