PT-2019-9311 · Npm · Just-Extend

Asgerf · Published 2019-02-01 · Updated 2019-10-09 · CVE-2018-16489

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions just-extend versions prior to 4.0.0

Description A prototype pollution issue allows an attack to inject properties onto Object.prototype through its functions, potentially adding or modifying properties of the Object prototype. These properties will be present on all objects.

Recommendations Update to version 4.0.0 or later.

Exploit

Fix

Special Elements Injection

Prototype Pollution

Resource Exhaustion

Weakness Enumeration

CWE-74

CWE-1321

CWE-400

Related Identifiers

CVE-2018-16489

GHSA-675M-85RW-J3W4

Affected Products

Just-Extend

References · 6

• 🔥 https://hackerone.com/reports/430291 · Exploit
• https://osv.dev/vulnerability/CVE-2018-16489 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-675m-85rw-j3w4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16489 · Security Note
• https://npmjs.com/advisories/780 · Note
• https://github.com/advisories/GHSA-675m-85rw-j3w4 · Note