Prototype Pollution

🗓️ 13 Apr 2022 03:18:28Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 22 Views

nconf is vulnerable to prototype pollution. The function ‘prototype.set()’ allows an attacker to get control of the value of "path" and modify attributes such as "__proto__", "constructor" and "prototype

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Pak for Multicloud Management Managed Services	19 Jul 202217:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to code injection due to CVE-2022-21803	26 May 202215:04	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager	25 Jul 202211:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)	4 Jul 202216:02	–	ibm
ATTACKERKB	CVE-2022-21803	12 Apr 202215:19	–	attackerkb
Circl	CVE-2022-21803	12 Apr 202220:17	–	circl
CNNVD	nconf 安全漏洞	12 Apr 202200:00	–	cnnvd
CNVD	nconf has unspecified vulnerabilities	15 Apr 202200:00	–	cnvd
CVE	CVE-2022-21803	12 Apr 202215:20	–	cve

Vulners

Node

nconf_project nconfRange0.1.14–0.11.3js

nconf_project nconfRange0.9.1–0.10.0js

Source	Link
github	www.github.com/indexzero/nconf/commit/26f69fb800b4503071e1434067518c445cc79e94
github	www.github.com/indexzero/nconf/pull/397/commits/26f69fb800b4503071e1434067518c445cc79e94
github	www.github.com/indexzero/nconf/pull/397
github	www.github.com/indexzero/nconf/releases/tag/v0.11.4

20 Apr 2022 17:08Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.17.3 - 7.5

CVSS 25

EPSS0.00932