PT-2018-16145 · Lodash · Lodash

Holyvier · Published 2018-06-07 · Updated 2024-02-16 · CVE-2018-3721

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.5

Description The issue allows a malicious user to modify the prototype of Object via proto, causing the addition or modification of an existing property that will exist on all objects. This is achieved through the defaultsDeep, merge, and mergeWith functions.

Recommendations Update to version 4.17.5 or later. As a temporary workaround, consider avoiding the use of the defaultsDeep, merge, and mergeWith functions until a patch is applied. Restrict access to these functions to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-471

CWE-1321

Related Identifiers

AZL-45420

CVE-2018-3721

GHSA-FVQR-27WR-82FM

Affected Products

Lodash

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml · Exploit
• 🔥 https://hackerone.com/reports/310443 · Exploit
• https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a · Patch
• https://ubuntu.com/security/CVE-2018-3721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3721 · Security Note
• https://osv.dev/vulnerability/AZL-45420 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3721 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3721 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3721 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvqr-27wr-82fm · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3721 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-3721 · Security Note
• https://npmjs.com/advisories/577 · Note
• https://security.netapp.com/advisory/ntap-20190919-0004 · Note
• https://t.me/cvenotify/71754 · Telegram Post