PT-2020-9149 · Unknown · Rdf-Graph-Array

Published 2020-02-24 · Updated 2021-04-13 · CVE-2019-10798

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions rdf-graph-array versions 0.3.0-rc6 and earlier

Description The issue concerns the manipulation of JavaScript objects, resulting in Prototype Pollution. Specifically, the rdf.Graph.prototype.add method can be tricked into adding or modifying properties of Object.prototype.

Recommendations For versions 0.3.0-rc6 and earlier, consider restricting the use of the rdf.Graph.prototype.add method until a patch is available. As a temporary workaround, avoid using this method to add or modify properties that could lead to Prototype Pollution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2019-10798

GHSA-PRV2-XWR7-HR57

SNYK-JS-RDFGRAPHARRAY-551803

Affected Products

Rdf-Graph-Array

References · 6

• 🔥 https://github.com/rdf-ext-archive/rdf-graph-array/blob/master/index.js#L211 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10798 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10798 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prv2-xwr7-hr57 · Vendor Advisory
• https://t.me/cvenotify/1177 · Telegram Post
• https://snyk.io/vuln/SNYK-JS-RDFGRAPHARRAY-551803 · Note