GoogleOSV:GHSA-JF85-CPCP-J695Prototype Pollution in lodash
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
0.015 Low
EPSS
Percentile
86.5%
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.12 or later.
| CPE | Name | Operator | Version |
|---|---|---|---|
| lodash-es | lt | 4.17.14 | |
| lodash | lt | 4.17.12 | |
| lodash.defaultsdeep | lt | 4.6.1 | |
| lodash-amd | lt | 4.17.13 |
References
access.redhat.com/errata/RHSA-2019:3024
github.com/lodash/lodash/pull/4336
nvd.nist.gov/vuln/detail/CVE-2019-10744
security.netapp.com/advisory/ntap-20191004-0005
snyk.io/vuln/SNYK-JS-LODASH-450202
support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS
www.npmjs.com/advisories/1065
www.oracle.com/security-alerts/cpujan2021.html
www.oracle.com/security-alerts/cpuoct2020.html
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
0.015 Low
EPSS
Percentile
86.5%