PT-2020-19760 · Mathjs · Math.Js

Published 2020-10-13 · Updated 2021-05-10 · CVE-2020-7743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mathjs versions prior to 7.5.1

Description The issue concerns Prototype Pollution via the deepExtend function, which is triggered by configuration updates. This function is part of the mathjs package.

Recommendations For versions prior to 7.5.1, update to version 7.5.1 or later to resolve the issue. As a temporary workaround, consider restricting configuration updates until the update is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2020-7743

GHSA-X2FC-MXCX-W4MF

SNYK-JAVA-ORGWEBJARS-1017113

SNYK-JAVA-ORGWEBJARSBOWER-1017112

SNYK-JAVA-ORGWEBJARSNPM-1017111

SNYK-JS-MATHJS-1016401

Affected Products

Math.Js

References · 12

• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1017111 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1017113 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1017112 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-MATHJS-1016401 · Exploit
• https://github.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7743 · Security Note
• https://osv.dev/vulnerability/GHSA-x2fc-mxcx-w4mf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7743 · Vendor Advisory
• https://github.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82 · Note
• https://github.com/josdejong/mathjs/blob/develop/HISTORY.md#2020-10-10-version-751 · Note
• https://npmjs.com/package/mathjs · Note
• https://t.me/cibsecurity/15221 · Telegram Post