PT-2019-12021 · Npm · Assign-Deep
CVE-2019-10745
·
Publicado
2019-08-20
·
Atualizado
2022-12-02
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
assign-deep versions prior to 0.4.8
assign-deep versions prior to 1.0.1
Description
The issue allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. This is due to the
assign function failing to validate which Object properties it updates. The function could be tricked into adding or modifying properties of Object.prototype using either a constructor or a proto payload.Recommendations
For versions prior to 0.4.8, upgrade to version 0.4.8 or later.
For versions prior to 1.0.1, upgrade to version 1.0.1 or later.
Exploit
Correção
Prototype Pollution
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Assign-Deep