PT-2019-9313 · Node.Js · Node-Extend

Asgerf · Publicado 2019-02-01 · Atualizado 2019-10-09 · CVE-2018-16491

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions node.extend versions prior to 1.1.7 node.extend versions prior to 2.0.1

Description A prototype pollution issue was discovered in node.extend that allows an attacker to inject arbitrary properties onto Object.prototype.

Recommendations Update to version 1.1.7 or later. Update to version 2.0.1 or later.

Exploit

Correção

Special Elements Injection

Resource Exhaustion

Enumeração de Fraquezas

CWE-74

CWE-400

Identificadores relacionados

CVE-2018-16491

GHSA-R96C-57PF-9JJM

Produtos afetados

Node-Extend

Referências · 11

• 🔥 https://hackerone.com/reports/430831 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16491 · Aviso do Fabricante
• https://npmjs.com/advisories/781 · Nota
• https://ubuntu.com/security/CVE-2018-16491 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16491 · Nota de Segurança
• https://github.com/advisories/GHSA-r96c-57pf-9jjm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16491 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16491 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16491 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-16491 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-r96c-57pf-9jjm · Aviso do Fabricante