PT-2018-13593 · Npm · Merge

Asgerf · Publicado 2018-10-30 · Atualizado 2019-10-09 · CVE-2018-16469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions merge versions prior to 1.2.1

Description The issue allows the merge.recursive function in the merge package to be tricked into adding or modifying properties of the Object prototype. This can lead to a denial of service attack, as these properties will be present on all objects.

Recommendations Update to version 1.2.1 or later.

Exploit

Correção

Prototype Pollution

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-1321

CWE-400

CWE-20

Identificadores relacionados

CVE-2018-16469

GHSA-F9CM-QMX5-M98H

Produtos afetados

Merge

Referências · 9

• 🔥 https://hackerone.com/reports/381194 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16469 · Aviso do Fabricante
• https://npmjs.com/advisories/722 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16469 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16469 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16469 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-f9cm-qmx5-m98h · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-16469 · Aviso do Fabricante
• https://github.com/advisories/GHSA-f9cm-qmx5-m98h · Nota