PT-2022-13783 · Unknown · Fullpage.Js

Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-1295

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fullpage.js versions prior to 4.0.2

Description The issue is related to Prototype Pollution in the fullpage.js GitHub repository. This affects the deepExtend utility, which is part of the fullPage utils available to developers via window.fp utils. The deepExtend utility is vulnerable, allowing an attacker to overwrite or create properties of an object type by exploiting the prototype pollution vulnerability. This can have severe effects on the application if the victim developer has used the overwritten property elsewhere in the code.

Recommendations For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the deepExtend utility until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2022-1295

GHSA-VPGW-FFH3-648H

Affected Products

Fullpage.Js

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1295.json · Exploit
• 🔥 https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a · Exploit
• https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48 · Patch
• https://osv.dev/vulnerability/GHSA-vpgw-ffh3-648h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1295 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1295 · Vendor Advisory
• https://github.com/alvarotrigo/fullpage.js · Note
• https://t.me/cvenotify/28693 · Telegram Post
• https://t.me/cibsecurity/40454 · Telegram Post