Lucene search

SnykCVE-2020-7774

HistoryNov 17, 2020 - 1:15 p.m.

CVE-2020-7774

2020-11-1713:15:12

CWE-1321

snyk

web.nvd.nist.gov

295

cve-2020-7774

nvd

y18n

prototype pollution

vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.269

Percentile

96.8%

JSON

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Affected configurations

Nvd

Node

y18n_projecty18nRange<3.2.2node.js

y18n_projecty18nRange5.0.0–5.0.5node.js

y18n_projecty18nMatch4.0.0node.js

Node

oraclegraalvmMatch19.3.5enterprise

oraclegraalvmMatch20.3.1.2enterprise

oraclegraalvmMatch21.0.0.2enterprise

Node

siemenssinec_infrastructure_network_servicesRange<1.0.1.1

VendorProductVersionCPE
y18n_projecty18n*cpe:2.3:a:y18n_project:y18n:*:*:*:*:*:node.js:*:*
y18n_projecty18n4.0.0cpe:2.3:a:y18n_project:y18n:4.0.0:*:*:*:*:node.js:*:*
oraclegraalvm19.3.5cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*
oraclegraalvm20.3.1.2cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*
oraclegraalvm21.0.0.2cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*
siemenssinec_infrastructure_network_services*cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
y18n_project	y18n	*	cpe:2.3:a:y18n_project:y18n::::::node.js::*
y18n_project	y18n	4.0.0	cpe:2.3:a:y18n_project:y18n:4.0.0:::::node.js::
oracle	graalvm	19.3.5	cpe:2.3:a:oracle:graalvm:19.3.5::::enterprise:::
oracle	graalvm	20.3.1.2	cpe:2.3:a:oracle:graalvm:20.3.1.2::::enterprise:::
oracle	graalvm	21.0.0.2	cpe:2.3:a:oracle:graalvm:21.0.0.2::::enterprise:::
siemens	sinec_infrastructure_network_services	*	cpe:2.3:a:siemens:sinec_infrastructure_network_services::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "y18n",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "5.0.5",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]