PT-2019-9312 · Mpath · Mpath

Cris_Semmle · Published 2019-02-01 · Updated 2021-09-02 · CVE-2018-16490

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions mpath versions prior to 0.5.1

Description A prototype pollution issue allows an attacker to inject arbitrary properties onto Object.prototype given certain input to mpath. This results in the added or modified properties being present on all objects.

Recommendations Update to version 0.5.1 or later.

Exploit

Fix

Special Elements Injection

Prototype Pollution

Resource Exhaustion

Weakness Enumeration

CWE-74

CWE-1321

CWE-400

Related Identifiers

CVE-2018-16490

GHSA-H466-J336-74WX

Affected Products

Mpath

References · 7

• 🔥 https://hackerone.com/reports/390860 · Exploit
• https://osv.dev/vulnerability/GHSA-h466-j336-74wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16490 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16490 · Vendor Advisory
• https://github.com/advisories/GHSA-h466-j336-74wx · Note
• https://npmjs.com/advisories/779 · Note
• https://t.me/cvenotify/20558 · Telegram Post