PT-2019-9310 · Npm · Deep-Defaults

Asgerf · Published 2019-02-01 · Updated 2019-10-09 · CVE-2018-16486

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions defaults-deep versions prior to a fixed version (no fixed version specified) defaults-deep (all versions)

Description A prototype pollution issue allows a malicious user to inject properties onto Object.prototype, given certain input. This can add or modify properties of the Object prototype, which will be present on all objects.

Recommendations For defaults-deep versions prior to a fixed version, consider selecting another module that can provide this functionality as no patch is currently available for this vulnerability. For all versions of defaults-deep, consider selecting another module that can provide this functionality as no patch is currently available for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Resource Exhaustion

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-74

CWE-400

CWE-345

Related Identifiers

CVE-2018-16486

GHSA-PJXW-22XF-6PWC

Affected Products

Deep-Defaults

References · 7

• 🔥 https://hackerone.com/reports/380878 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16486 · Security Note
• https://osv.dev/vulnerability/GHSA-pjxw-22xf-6pwc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16486 · Vendor Advisory
• https://github.com/jonschlinkert/defaults-deep · Note
• https://npmjs.com/advisories/778 · Note
• https://github.com/advisories/GHSA-pjxw-22xf-6pwc · Note