PT-2018-16171 · Npm+4 · Deep-Extend+4

Holyvier · Publicado 2018-07-03 · Atualizado 2021-02-16 · CVE-2018-3750

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions deep-extend versions <= 0.5.0

Description The issue allows an attacker to modify the prototype of Object when they can control part of the structure passed to the utilities function. This can enable an attacker to add or modify existing properties that will exist on all objects.

Recommendations Update to version 0.5.1 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALSA-2021:0549

CESA-2021_0549

CVE-2018-3750

GHSA-HR2V-3952-633Q

RHSA-2020:2625

RHSA-2021:0485

RHSA-2021:0549

RHSA-2021_0549

RLSA-2021:0549

Produtos afetados

Almalinux

Centos

Red Hat

Rocky Linux

Deep-Extend

Referências · 32

• 🔥 https://hackerone.com/reports/311333 · Exploit
• https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703 · Nota
• https://github.com/unclechu/node-deep-extend/issues/39 · Nota
• https://github.com/unclechu/node-deep-extend/pull/40 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3750 · Nota de Segurança
• https://npmjs.com/advisories/612 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1892430 · Nota
• https://cve.org/CVERecord?id=CVE-2018-3750 · Nota de Segurança
• https://vulners.com/cve/CVE-2019-10747 · Nota
• https://errata.almalinux.org/8/ALSA-2021-0549.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1795479 · Nota
• https://ubuntu.com/security/CVE-2018-3750 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALSA-2021:0549 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-3750 · Aviso do Fabricante
• https://vulners.com/cve/CVE-2020-7788 · Nota