PT-2020-19778 · Json Ptr · Json-Ptr
Published
2020-11-10
·
Updated
2022-12-02
·
CVE-2020-7766
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
json-ptr versions prior to 2.1.0
Description
The issue occurs in the set operation when the force flag is set to true. The function recursively sets the property in the target object, however it does not properly check the key being set, leading to a prototype pollution. This happens in the
set operation of the json-ptr package.Recommendations
For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the
set operation when the force flag is set to true until a patch is available. Restrict access to the json-ptr package to minimize the risk of exploitation. Avoid using the force flag in the set operation until the issue is resolved.Exploit
Fix
Prototype Pollution
Special Elements Injection
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Json-Ptr