PT-2023-20517 · Unknown · Underscore-Keypath

Peng Zhou + 1 · Publicado 2023-08-01 · Atualizado 2023-08-04 · CVE-2023-26139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions underscore-keypath versions 0.0.11 and later

Description The issue arises from improper input sanitization in the setProperty() function, allowing the usage of arguments like proto and leading to Prototype Pollution. This can be exploited due to the lack of proper input validation.

Recommendations For versions 0.0.11 and later, consider disabling the setProperty() function until a patch is available to prevent exploitation. Restrict the use of the name argument in the setProperty() function to minimize the risk of Prototype Pollution. Avoid using arguments like proto in the setProperty() function until the issue is resolved.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2023-26139

GHSA-GPVC-MX6G-CCHV

Produtos afetados

Underscore-Keypath

Referências · 8

• https://github.com/jeeeyul/underscore-keypath · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26139 · Nota de Segurança
• https://gist.github.com/lelecolacola123/cc0d1e73780127aea9482c05f2ff3252 · Nota
• https://security.snyk.io/vuln/SNYK-JS-UNDERSCOREKEYPATH-5416714 · Nota
• https://osv.dev/vulnerability/GHSA-gpvc-mx6g-cchv · Aviso do Fabricante
• https://t.me/cibsecurity/67496 · Publicação no Telegram
• https://t.me/cvenotify/55650 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26139 · Aviso do Fabricante