PT-2020-6069 · Yargs +4 · Yargs-Parser +4

🗓️ 16 Mar 2020 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 5 Views

Prototype pollution in yargs-parser allows modifying Object.prototype via a proto payload; upgrade to specified versions.

Reporter	Title	Published	Views	Family All 1004
vulnersOsv	@agneta/cli (>=0.14.7, <=0.14.15), @servisbot/servisbot-cli (>=9.4.0, <=10.3.2) +3 more potentially affected by CVE-2020-7774 via y18n (4.0.0)	25 Oct 202014:24	–	vulnersosv
vulnersOsv	00.demo (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +39571 more potentially affected by CVE-2020-7608 via yargs-parser (>=6.0.1, <=13.1.1)	4 Sep 202018:00	–	vulnersosv
vulnersOsv	@agneta/cli (>=0.14.7, <=0.14.15), @servisbot/servisbot-cli (>=9.4.0, <=10.3.2) +3 more potentially affected by CVE-2020-7774 via y18n (4.0.0)	29 Mar 202116:05	–	vulnersosv
vulnersOsv	00.demo (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +39571 more potentially affected by CVE-2020-7608 via yargs-parser (>=6.0.1, <=13.1.1)	16 Mar 202016:35	–	vulnersosv
vulnersOsv	another-work-report-generator (>=3.4.1, <=3.4.5), largest-package (>=5.0.0, <=8.0.0) +5 more potentially affected by CVE-2020-7608 via yargs-parser (5.0.0-security.0)	16 Mar 202016:35	–	vulnersosv
vulnersOsv	another-work-report-generator (>=3.4.1, <=3.4.5), largest-package (>=5.0.0, <=8.0.0) +5 more potentially affected by CVE-2020-7608 via yargs-parser (5.0.0-security.0)	4 Sep 202018:00	–	vulnersosv
vulnersOsv	@absolunet/ioc (2.0.0), @absolunet/nwayo-workflow (>=3.7.2, <=3.8.1) +885 more potentially affected by CVE-2020-7608 via yargs-parser (>=16.0.0, <=18.1.0)	16 Mar 202016:35	–	vulnersosv
vulnersOsv	@badgeup/badgeup-ionic-client (>=1.0.1, <=1.0.3), @codedungeon/code-assistant (>=0.0.1, <=0.0.4-dev.53) +42 more potentially affected by CVE-2020-8116 via dot-prop (>=4.0.0, <=4.2.0)	29 Jul 202020:56	–	vulnersosv
vulnersOsv	@admixltd/admix-error (>=1.3.7, <=2.0.2), @admixltd/admix-jwt (>=1.9.4, <=2.0.0) +93 more potentially affected by CVE-2020-15095 via npm (>=6.0.0, <=6.14.5)	7 Jul 202018:56	–	vulnersosv
vulnersOsv	37fis (>=1.0.0, <=1.0.2), 3loc (>=0.2.0, <=0.4.0) +1851 more potentially affected by CVE-2020-7788 via ini (>=1.0.0, <=1.3.5)	10 Dec 202016:53	–	vulnersosv

Source	Link
github	www.github.com/masahiro331/CVE-2020-8277
snyk	www.snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
errata	www.errata.almalinux.org/8/ALSA-2021-0548.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-7608
bdu	www.bdu.fstec.ru/vul/2021-02884
bdu	www.bdu.fstec.ru/vul/2021-00883
osv	www.osv.dev/vulnerability/ALSA-2020:5499
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
advisories	www.advisories.mageia.org/MGASA-2021-0170.html

15 Nov 2022 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3 - 9.8

CVSS 27.5

EPSS0.69377