Design/Logic Flaw

🗓️ 05 Jul 2023 14:15:00Reported by PRIOn knowledge baseType

protobuf.js allows Prototype Pollution, allowing attacker to pollute Object.prototype. Exploitation via parse, loading .proto files, or untrusted input to setParsedOption and util.setProperty

Reporter	Title	Published	Views	Family All 55
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js modules affect IBM Voice Gateway	14 Aug 202319:58	–	ibm
IBM Security Bulletins	Security Bulletin: protobuf.js component is vulnerable which is used by IBM Maximo Application Suite [CVE-2023-36665]	29 Aug 202321:00	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to prototype pollution due to the protobufjs package (CVE-2022-25878)	23 Jul 202513:20	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	15 Feb 202413:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules protobuf.js, vm2 and word-wrap [CVE-2023-36665, CVE-2023-37903, CVE-2023-37466 and CVE-2023-26115]	11 Sep 202316:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands may be vulnerable to arbitrary code execution due to CVE-2022-25878	4 Nov 202217:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for June 2022	26 Jul 202207:54	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities	11 Aug 202516:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Google PubSub nodes are vulnerable to arbitrary code execution due to [CVE-2023-36665]	31 Jul 202317:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm

Source	Link
github	www.github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d
github	www.github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4
github	www.github.com/protobufjs/protobuf.js/pull/1899
code-intelligence	www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665
github	www.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4

07 Sep 2023 22:15Current

8.3High risk

Vulners AI Score8.3

EPSS0.01688