CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-44310
High (7.5) in ecdh project ecdh. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in ecdh 0.2.0.
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWE
- CWE-668
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ecdh_project:ecdh
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p2hp-3wv3-4w74 | npm | ecdh | <0.2.0 | 0.2.0 |