PT-2020-6065 · Object Path+2 · Object-Path+2

Alromh87 + 3 · Published 2020-10-19 · Updated 2023-03-22 · CVE-2020-15256

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions object-path versions <= 0.11.4

Description A prototype pollution vulnerability has been found in the set() method of the object-path library. The vulnerability is limited to the includeInheritedProps mode, which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. Any usage of set() in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5.

Recommendations For versions <= 0.11.4, upgrade to version 0.11.5 to fix the issue. As a temporary workaround, do not use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-471

CWE-20

Related Identifiers

BDU:2021-02875

CVE-2020-15256

DLA-3291-1

GHSA-CWX2-736X-MF6W

USN-5967-1

Affected Products

Linuxmint

Ubuntu

Object-Path

References · 23

• https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15256 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5967-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15256 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5967-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23434 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15256 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3291-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15256 · Security Note
• https://bdu.fstec.ru/vul/2021-02875 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-15256 · Security Note
• https://osv.dev/vulnerability/GHSA-cwx2-736x-mf6w · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3805 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15256 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15256 · Vendor Advisory