PT-2022-8905 · Unknown+1 · Properties-Reader+1

Eugene Lim · CVE-2020-28471 · Published 2022-07-19 · Updated 2025-11-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions properties-reader versions prior to 2.2.0

Description The issue concerns a prototype pollution vulnerability. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation are not provided.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 to resolve the issue.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2020-28471

GHSA-JXVF-M3X5-MXWQ

Affected Products

Bitbucket

Properties-Reader

References · 11

• 🔥 https://github.com/steveukx/properties/issues/40 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-PROPERTIESREADER-1048968 · Exploit
• https://github.com/steveukx/properties/commit/0877cc871db9865f58dd9389ce99e61be05380a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28471 · Security Note
• https://osv.dev/vulnerability/GHSA-jxvf-m3x5-mxwq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28471 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28471 · Security Note
• https://github.com/steveukx/properties/commit/4e4bc392ecfd0a128f48c1d69f64a0d7194fcaab · Note
• https://github.com/steveukx/properties · Note
• https://t.me/cvenotify/33730 · Telegram Post
• https://jira.atlassian.com/browse/BSERV-20258 · Note