CVE-2022-39357 - CVE House
Back to Database
Status published High CVE-2022-39357

Winter vulnerable to Prototype Pollution in Snowboard framework

Vulnerability Description

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39357

Credits & Attribution

No credits recorded in the NVD database.

References

More from wintercms

View All →
CVE-2024-54149
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
High 8.5
CVE-2024-32003
Dusk plugin may allow unfettered user authentication in misconfigured installs
High 8.8
CVE-2023-52085
Winter CMS Local File Inclusion through Server Side Template Injection
Low 3.3
CVE-2023-52084
Winter CMS Stored XSS through Backend ColorPicker FormWidget
Low 2
CVE-2023-52083
Stored XSS through privileged upload of Media Manager file followed by renaming
Low 2

Affected Vendor

Affected Software

winter
Vulnerable Versions:
>= 1.1.8, < 1.1.10, = 1.2.0

Timeline

Official Publish: October 26th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.