PT-2018-16143 · Npm · Mixin-Deep

Holyvier · Publicado 2018-06-07 · Atualizado 2023-02-28 · CVE-2018-3719

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mixin-deep versions prior to 1.3.1

Description The issue allows a malicious user to modify the prototype of Object via proto, causing the addition or modification of an existing property that will exist on all objects. This is achieved through prototype pollution via merging functions.

Recommendations Update to version 1.3.1 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-471

CWE-20

Identificadores relacionados

CVE-2018-3719

GHSA-3MPR-HQ3P-49H9

Produtos afetados

Mixin-Deep

Referências · 13

• 🔥 https://hackerone.com/reports/311236 · Exploit
• https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3719 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3719 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-3719 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-3719 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-3719 · Aviso do Fabricante
• https://npmjs.com/advisories/578 · Nota
• https://nodesecurity.io/advisories/578 · Nota
• https://osv.dev/vulnerability/GHSA-3mpr-hq3p-49h9 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3719 · Aviso do Fabricante
• https://github.com/advisories/GHSA-3mpr-hq3p-49h9 · Nota
• https://cve.org/CVERecord?id=CVE-2018-3719 · Nota de Segurança