PT-2018-13593 · Npm · Merge

Asgerf · Published 2018-10-30 · Updated 2019-10-09 · CVE-2018-16469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions merge versions prior to 1.2.1

Description The issue allows the merge.recursive function in the merge package to be tricked into adding or modifying properties of the Object prototype. This can lead to a denial of service attack, as these properties will be present on all objects.

Recommendations Update to version 1.2.1 or later.

Exploit

Fix

Prototype Pollution

Resource Exhaustion

RCE

Weakness Enumeration

CWE-1321

CWE-400

CWE-20

Related Identifiers

CVE-2018-16469

GHSA-F9CM-QMX5-M98H

Affected Products

Merge

References · 9

• 🔥 https://hackerone.com/reports/381194 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16469 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16469 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16469 · Security Note
• https://osv.dev/vulnerability/GHSA-f9cm-qmx5-m98h · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16469 · Vendor Advisory
• https://npmjs.com/advisories/722 · Note
• https://github.com/advisories/GHSA-f9cm-qmx5-m98h · Note