Lucene search

GitHub Advisory DatabaseGHSA-5P42-M6F3-HPMJ

HistoryAug 17, 2023 - 12:30 a.m.

tree-kit Prototype Pollution vulnerability

2023-08-1700:30:26

CWE-1321

GitHub Advisory Database

github.com

prototype pollution

cronvel

tree-kit

vulnerability

remote attacker

arbitrary code

extend function

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.3%

JSON

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

Affected configurations

Vulners

Node

tree_kit_projecttree_kitRange<0.7.5node.js

VendorProductVersionCPE
tree_kit_projecttree_kit*cpe:2.3:a:tree_kit_project:tree_kit:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
tree_kit_project	tree_kit	*	cpe:2.3:a:tree_kit_project:tree_kit::::::node.js::*

References

tree-kit.com

github.com/advisories/GHSA-5p42-m6f3-hpmj

github.com/cronvel/tree-kit

github.com/cronvel/tree-kit/commit/61bf10cf0dbddaeea3f198cfe7cb469f360d82bc

nvd.nist.gov/vuln/detail/CVE-2023-38894

www.code-intelligence.com/blog/treekit-prototype-pollution-cve-2023-38894

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.3%

JSON

Related for GHSA-5P42-M6F3-HPMJ