Prototype Pollution

2021-09-1306:49:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prototype pollution

set-value

cve-2019-10747

bypass

user-provided keys

arrays

EPSS

0.064

Percentile

93.8%

JSON

set-value is vulnerable to prototype pollution. Lack of validation in type of user-provided keys in the path parameter causes a bypass of CVE-2019-10747. The exploit is possible when the user-provided keys used in the path parameter are arrays.

Affected configurations

Vulners

Node

-node-set-value\Matchsid3.0.1-2

set-value_projectset-valueMatch3.0.0node.js

-node-set-value\Matchsid3.0.1-2

set-value_projectset-valueMatch3.0.0node.js

set-value_projectset-valueRange≤2.0.0node.js

set-value_projectset-valueRange≤4.0.0node.js

VendorProductVersionCPE
-node-set-value\sidcpe:2.3:a:-:node-set-value\:sid:3.0.1-2:*:*:*:*:*:*:*
set-value_projectset-value3.0.0cpe:2.3:a:set-value_project:set-value:3.0.0:*:*:*:*:node.js:*:*
set-value_projectset-value*cpe:2.3:a:set-value_project:set-value:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
-	node-set-value\	sid	cpe:2.3:a:-:node-set-value\:sid:3.0.1-2:::::::*
set-value_project	set-value	3.0.0	cpe:2.3:a:set-value_project:set-value:3.0.0:::::node.js::
set-value_project	set-value	*	cpe:2.3:a:set-value_project:set-value::::::node.js::*