CVE-2022-31004

Name: CVE-2022-31004
Creator: NVD / NIST
Published: 2022-06-02T14:15:56.433+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.92%

Last modified Jun 17, 2026

CVE-2022-31004 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. EPSS estimates a 0.92% chance of exploitation in the next 30 days.

Description

CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not development. If this method were called in production, it is possible that it would write the plaintext key to disk. A patch is not available as of time of publication but is anticipated as a "hot fix" for version 1.1.1 and for the 2.x branch.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

0.92%

55.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Mitre	Cve-Services	>= 1.1.1

References

https://github.com/CVEProject/cve-services/blob/6b085e481fd3b084a8828ef7489c6b82fa415c92/src/utils/data.js#L68-L83Exploit, Third Party Advisory
https://github.com/CVEProject/cve-services/security/advisories/GHSA-mpwm-rmqp-7629Exploit, Third Party Advisory
https://github.com/CVEProject/cve-services/blob/6b085e481fd3b084a8828ef7489c6b82fa415c92/src/utils/data.js#L68-L83Exploit, Third Party Advisory
https://github.com/CVEProject/cve-services/security/advisories/GHSA-mpwm-rmqp-7629Exploit, Third Party Advisory

Timeline

Published: Jun 2, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-31004?

How severe is CVE-2022-31004?

CVE-2022-31004 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.92% probability of exploitation in the next 30 days.

How do I fix CVE-2022-31004?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-31004?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST