PT-2020-19741 · Locutus · Locutus

Nerdjs · Published 2020-09-01 · Updated 2022-12-02 · CVE-2020-7719

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions locutus versions prior to 2.0.12

Description The issue concerns Prototype Pollution via the php.strings.parse str function. This affects the locutus package, allowing for potential manipulation of objects.

Recommendations For versions prior to 2.0.12, update to version 2.0.12 or later to resolve the issue.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-915

CWE-20

Related Identifiers

CVE-2020-7719

GHSA-F98M-Q3HR-P5WQ

SNYK-JS-LOCUTUS-598675

Affected Products

Locutus

References · 7

• 🔥 https://github.com/kvz/locutus/pull/418 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-LOCUTUS-598675 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7719 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7719 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f98m-q3hr-p5wq · Vendor Advisory
• https://github.com/locutusjs/locutus/commit/0eb16d8541838e80f3c2340a9ef93ded7c97290f · Note
• https://github.com/kvz/locutus · Note