PT-2019-9312 · Mpath · Mpath

Cris_Semmle · Publicado 2019-02-01 · Atualizado 2021-09-02 · CVE-2018-16490

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions mpath versions prior to 0.5.1

Description A prototype pollution issue allows an attacker to inject arbitrary properties onto Object.prototype given certain input to mpath. This results in the added or modified properties being present on all objects.

Recommendations Update to version 0.5.1 or later.

Exploit

Correção

Special Elements Injection

Prototype Pollution

Resource Exhaustion

Enumeração de Fraquezas

CWE-74

CWE-1321

CWE-400

Identificadores relacionados

CVE-2018-16490

GHSA-H466-J336-74WX

Produtos afetados

Mpath

Referências · 7

• 🔥 https://hackerone.com/reports/390860 · Exploit
• https://github.com/advisories/GHSA-h466-j336-74wx · Nota
• https://npmjs.com/advisories/779 · Nota
• https://osv.dev/vulnerability/GHSA-h466-j336-74wx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16490 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16490 · Aviso do Fabricante
• https://t.me/cvenotify/20558 · Publicação no Telegram