PT-2023-20489 · Rangy · Rangy

Peng Zhou + 1 · Publicado 2023-02-24 · Atualizado 2025-03-11 · CVE-2023-26102

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions rangy versions all

Description The issue concerns Prototype Pollution in the rangy package. It occurs when using the extend() function in the file rangy-core.js, which utilizes a recursive merge. This can allow an attacker to modify properties of the Object.prototype.

Recommendations For all versions, consider disabling the extend() function in rangy-core.js as a temporary workaround until a patch is available. Restrict access to the rangy-core.js file to minimize the risk of exploitation. Avoid using the extend() function in the affected file until the issue is resolved.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2023-26102

GHSA-65RP-MHQF-8GJ3

Produtos afetados

Rangy

Referências · 9

• 🔥 https://github.com/timdown/rangy/issues/478 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702 · Exploit
• https://github.com/timdown/rangy · Nota
• https://osv.dev/vulnerability/GHSA-65rp-mhqf-8gj3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26102 · Aviso do Fabricante
• https://t.me/cvenotify/114253 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26102 · Nota de Segurança
• https://t.me/cibsecurity/58842 · Publicação no Telegram
• https://t.me/cvenotify/44874 · Publicação no Telegram