Lucene search

SnykCVELIST:CVE-2020-7714

HistorySep 01, 2020 - 9:20 a.m.

CVE-2020-7714 Prototype Pollution

2020-09-0109:20:19

snyk

www.cve.org

confucious package

vulnerability

cve-2020-7714

prototype pollution

set function

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.6

Confidence

High

EPSS

0.007

Percentile

79.9%

JSON

All versions of package confucious are vulnerable to Prototype Pollution via the set function.

CNA Affected

[
  {
    "product": "confucious",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

snyk.io/vuln/SNYK-JS-CONFUCIOUS-598665

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.6

Confidence

High

EPSS

0.007

Percentile

79.9%

JSON

Related for CVELIST:CVE-2020-7714