PT-2020-16972 · Getobject+1 · Getobject+1

Published 2020-12-29 · Updated 2022-11-11 · CVE-2020-28282

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions getobject version 0.1.0

Description The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability.

Recommendations For version 0.1.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

AZL-44940

CVE-2020-28282

GHSA-957J-59C2-J692

OESA-2022-1543

OESA-2022-2052

Affected Products

Astra Linux

Getobject

References · 19

• 🔥 https://github.com/cowboy/node-getobject/blob/aba04a8e1d6180eb39eff09990c3a43886ba8937/lib/getobject.js#L48 · Exploit
• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2020-28282 · Exploit
• https://cve.org/CVERecord?id=CVE-2020-28282 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28282 · Security Note
• https://osv.dev/vulnerability/GHSA-957j-59c2-j692 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28282 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28282 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44940 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1543 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28282 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-28282 · Vendor Advisory
• https://github.com/cowboy/node-getobject/commit/84071748fa407caa8f824e0d0b9c1cde9ec56633 · Note
• https://github.com/cowboy/node-getobject · Note