PT-2020-19656 · Npm · Express-Mock-Middleware

Published 2020-04-07 · Updated 2022-12-02 · CVE-2020-7616

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions express-mock-middleware versions 0.0.0 through 0.0.6

Description The issue allows exported functions by the package to be tricked into adding or modifying properties of the Object.prototype, which can be exploited by creating a new directory with attack code that will be exported by express-mock-middleware. This is considered a low-risk issue.

Recommendations For express-mock-middleware versions 0.0.0 through 0.0.6, consider updating to a version that fixes the Prototype Pollution issue, as the current version can be exploited by manipulating the Object.prototype.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2020-7616

GHSA-V39H-QM32-8GWQ

SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120

Affected Products

Express-Mock-Middleware

References · 5

• 🔥 https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7616 · Security Note
• https://osv.dev/vulnerability/GHSA-v39h-qm32-8gwq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7616 · Vendor Advisory
• https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39 · Note