PT-2020-19674 · Confinit · Confinit

Published 2020-04-06 · Updated 2022-12-02 · CVE-2020-7638

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions confinit versions 0.3.0 and earlier

Description The issue concerns Prototype Pollution, where the setDeepProperty function can be tricked into adding or modifying properties of Object.prototype using a proto payload. This allows for potential manipulation of the object's prototype chain.

Recommendations For confinit versions 0.3.0 and earlier, as a temporary workaround, consider disabling the setDeepProperty function until a patch is available. Restrict access to the setDeepProperty function to minimize the risk of exploitation. Avoid using the proto payload in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2020-7638

GHSA-JGPQ-G82G-6C39

SNYK-JS-CONFINIT-564433

Affected Products

Confinit

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-CONFINIT-564433 · Exploit
• https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7638 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7638 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jgpq-g82g-6c39 · Vendor Advisory
• https://t.me/cvenotify/2430 · Telegram Post