PT-2018-13595 · Npm · Cached-Path-Relative

Cristian-Alexandru Staicu · Published 2018-11-06 · Updated 2023-02-03 · CVE-2018-16472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cached-path-relative versions <=1.0.1

Description A prototype pollution attack allows an attacker to inject properties on Object.prototype, which are then inherited by all the JS objects through the prototype chain, causing a Denial of Service (DoS) attack.

Recommendations Update to version 1.0.2 or later.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2018-16472

DLA-3221-1

GHSA-HC9W-4P87-J549

Affected Products

Cached-Path-Relative

References · 15

• https://security-tracker.debian.org/tracker/CVE-2018-16472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16472 · Security Note
• https://osv.dev/vulnerability/DLA-3221-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hc9w-4p87-j549 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16472 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16472 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16472 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16472 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16472 · Security Note
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/480.json · Note
• https://github.com/ashaffer/cached-path-relative/issues/3 · Note
• https://hackerone.com/reports/390847 · Note
• https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html · Note
• https://github.com/advisories/GHSA-hc9w-4p87-j549 · Note
• https://npmjs.com/advisories/739 · Note