PT-2020-17268 · Mquery · Mquery

Vkarpov15 · Published 2020-12-11 · Updated 2020-12-18 · CVE-2020-35149

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions mquery versions prior to 3.2.3

Description The issue allows a pollution attack because a special property, such as proto, can be copied during a merge or clone operation. This occurs in the lib/utils.js file.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the merge or clone operations in the lib/utils.js file to prevent the pollution attack.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-35149

GHSA-45Q2-34RF-MR94

Affected Products

Mquery

References · 13

• https://github.com/aheckmann/mquery/commit/792e69fd0a7281a0300be5cade5a6d7c1d468ad4 · Patch
• https://osv.dev/vulnerability/CVE-2020-35149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35149 · Security Note
• https://osv.dev/vulnerability/GHSA-45q2-34rf-mr94 · Vendor Advisory
• https://t.me/cibsecurity/20629 · Telegram Post
• https://t.me/cibsecurity/20609 · Telegram Post
• https://t.me/cibsecurity/20497 · Telegram Post
• https://t.me/cibsecurity/20570 · Telegram Post
• https://t.me/cibsecurity/20550 · Telegram Post
• https://t.me/cibsecurity/20478 · Telegram Post
• https://t.me/cibsecurity/20517 · Telegram Post
• https://t.me/cibsecurity/20589 · Telegram Post
• https://t.me/cibsecurity/20537 · Telegram Post