Lucene search

Veracode Vulnerability DatabaseVERACODE:35003

HistoryApr 07, 2022 - 4:36 a.m.

Prototype Pollution

2022-04-0704:36:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

async

mapvalues

malicious property types

unintended privileges

EPSS

0.002

Percentile

54.3%

JSON

async is vulnerable to prototype pollution. An attacker is able to inject malicious property types via mapValues method and gain unintended privileges due to prototype pollution vulnerability.

References

github.com/caolan/async/blob/master/lib/internal/iterator.js

github.com/caolan/async/blob/master/lib/mapValuesLimit.js

github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264

github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d

github.com/caolan/async/compare/v2.6.3...v2.6.4

github.com/caolan/async/pull/1828

jsfiddle.net/oz5twjd9/

lists.fedoraproject.org/archives/list/[email protected]/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/

lists.fedoraproject.org/archives/list/[email protected]/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/

EPSS

0.002

Percentile

54.3%

JSON

Related for VERACODE:35003