PT-2023-8584 · Dot-Diver · Dot-Diver

D3Ng03 + 1 · Publicado 2023-11-03 · Atualizado 2023-12-26 · CVE-2023-45827

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dot-diver versions prior to 1.0.2

Description The issue is related to a Prototype Pollution vulnerability in the setByPath function, which can lead to remote code execution (RCE). This vulnerability allows an attacker to modify object attributes, potentially enabling them to execute arbitrary code. The vulnerability is present in versions prior to 1.0.2 of the dot-diver library.

Recommendations For versions prior to 1.0.2, upgrade to release 1.0.2 or later to address the Prototype Pollution vulnerability in the setByPath function. As a temporary workaround, consider restricting the use of the setByPath function until a patch is applied.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

BDU:2024-01227

CVE-2023-45827

GHSA-9W5F-MW3P-PJ47

Produtos afetados

Dot-Diver

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45827.json · Exploit
• https://github.com/clickbar/dot-diver/security/advisories/GHSA-9w5f-mw3p-pj47 · Aviso do Fabricante
• https://github.com/clickbar/dot-diver · Nota
• https://github.com/clickbar/dot-diver/commit/9790834cf4c2bca75db00e588e58056dacaf602f · Nota
• https://github.com/clickbar/dot-diver/commit/98daf567390d816fd378ec998eefe2e97f293d5a · Correção
• https://t.me/true_secator/5246 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45827 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9w5f-mw3p-pj47 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45827 · Aviso do Fabricante
• https://t.me/cibsecurity/73621 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2024-01227 · Nota de Segurança