PT-2018-16145 · Lodash · Lodash

Holyvier · Publicado 2018-06-07 · Atualizado 2024-02-16 · CVE-2018-3721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.5

Description The issue allows a malicious user to modify the prototype of Object via proto, causing the addition or modification of an existing property that will exist on all objects. This is achieved through the defaultsDeep, merge, and mergeWith functions.

Recommendations Update to version 4.17.5 or later. As a temporary workaround, consider avoiding the use of the defaultsDeep, merge, and mergeWith functions until a patch is applied. Restrict access to these functions to minimize the risk of exploitation.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-471

CWE-1321

Identificadores relacionados

AZL-45420

CVE-2018-3721

GHSA-FVQR-27WR-82FM

Produtos afetados

Lodash

Referências · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml · Exploit
• 🔥 https://hackerone.com/reports/310443 · Exploit
• https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a · Correção
• https://npmjs.com/advisories/577 · Nota
• https://ubuntu.com/security/CVE-2018-3721 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20190919-0004 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3721 · Nota de Segurança
• https://t.me/cvenotify/71754 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-45420 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-3721 · Aviso do Fabricante
• https://snyk.io/vuln/npm:lodash:20180130 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3721 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-3721 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fvqr-27wr-82fm · Aviso do Fabricante
• https://github.com/advisories/GHSA-fvqr-27wr-82fm · Nota