PT-2021-11543 · Jointjs · Jointjs

Published 2021-01-19 · Updated 2021-09-21 · CVE-2020-28480

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: jointjs versions prior to 3.3.0

Description: The issue arises from the util.setByPath function, where the path used to access the object's key and set the value is not properly sanitized. This leads to a Prototype Pollution, allowing potential manipulation of the object's properties.

Recommendations: For jointjs versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the util.setByPath function until a patch is applied.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-28480

GHSA-QWP9-52H8-XGG8

SNYK-JAVA-ORGWEBJARSBOWER-1062037

SNYK-JAVA-ORGWEBJARSNPM-1062036

SNYK-JS-JOINTJS-1024444

Affected Products

Jointjs

References · 10

• https://osv.dev/vulnerability/CVE-2020-28480 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwp9-52h8-xgg8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28480 · Security Note
• https://github.com/clientIO/joint/blob/master/src/util/util.mjs%23L150 · Note
• https://github.com/clientIO/joint/pull/1406 · Note
• https://t.me/cibsecurity/22273 · Telegram Post
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062037 · Note
• https://snyk.io/vuln/SNYK-JS-JOINTJS-1024444 · Note
• https://t.me/cibsecurity/29191 · Telegram Post
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1062036 · Note