Prototype Pollution

2022-10-2705:34:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

wintercms

winter

prototype pollution

snowboard class

plugin loader

object properties

EPSS

0.005

Percentile

75.5%

JSON

wintercms/winter is vulnerable to prototype pollution. The vulnerability exists in the main Snowboard class as well as its plugin loader where an attacker can control the default values of an object’s properties. This allows the attacker to tamper with the logic of the application.