Prototype Pollution

🗓️ 17 Dec 2020 03:35:03Reported by Veracode Vulnerability DatabaseType

datatables.net vulnerable to prototype pollution as it does not sanitize `__proto__` and `constructor` header

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache and Node.js affect IBM Spectrum Protect Plus	24 Apr 202106:55	–	ibm
IBM Security Bulletins	Security Bulletin: A Prototype Pollution vulnerability in jquery.dataTables affects IBM Tivoli Network Manager IP Edition (ITNM) (CVE-2020-28458)	23 Oct 202511:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	25 Oct 202115:46	–	ibm
GithubExploit	Exploit for Prototype Pollution in Datatables Datatables.Net	4 Dec 202508:04	–	githubexploit
CBLMariner	CVE-2020-28458 affecting package reaper for versions less than 3.1.1-15	22 Nov 202420:58	–	cbl_mariner
Circl	CVE-2020-28458	16 Dec 202015:25	–	circl
CNNVD	Sprymedia Datatables Input Validation Error Vulnerability	16 Dec 202000:00	–	cnnvd
Check Point Advisories	JavaScript Prototype Pollution (CVE-2020-28269; CVE-2020-28272; CVE-2020-28273; CVE-2020-28442; CVE-2020-28458; CVE-2020-28472; CVE-2020-7778; CVE-2020-8158; CVE-2020-8203; CVE-2021-25912; CVE-2021-44906)	21 Jun 202000:00	–	checkpoint_advisories
CVE	CVE-2020-28458	16 Dec 202010:35	–	cve
Cvelist	CVE-2020-28458 Prototype Pollution	16 Dec 202010:35	–	cvelist

Vulners

Node

datatables datatables.netRange1.10.12–1.10.21js

Source	Link
github	www.github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03
github	www.github.com/418sec/huntr/pull/827
github	www.github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766
security	www.security.netapp.com/advisory/ntap-20240621-0006/

21 Jun 2024 20:35Current

2.9Low risk

Vulners AI Score2.9

CVSS 3.17.3

CVSS 27.5

EPSS0.01228