PT-2018-16171 · Npm+4 · Deep-Extend+4

Holyvier · Published 2018-07-03 · Updated 2021-02-16 · CVE-2018-3750

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions deep-extend versions <= 0.5.0

Description The issue allows an attacker to modify the prototype of Object when they can control part of the structure passed to the utilities function. This can enable an attacker to add or modify existing properties that will exist on all objects.

Recommendations Update to version 0.5.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2021:0549

CESA-2021_0549

CVE-2018-3750

GHSA-HR2V-3952-633Q

RHSA-2020:2625

RHSA-2021:0485

RHSA-2021:0549

RHSA-2021_0549

RLSA-2021:0549

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Deep-Extend

References · 32

• 🔥 https://hackerone.com/reports/311333 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3750 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-3750 · Security Note
• https://errata.almalinux.org/8/ALSA-2021-0549.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3750 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:0549 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3750 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hr2v-3952-633q · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:0549 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3750 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3750 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:0549 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3750 · Vendor Advisory
• https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703 · Note
• https://github.com/unclechu/node-deep-extend/issues/39 · Note