Prototype Pollution

2023-08-0209:25:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

underscore-keypath

vulnerability

prototype pollution

setproperty

__proto__

obj

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

35.0%

JSON

underscore-keypath is vulnerable to Prototype Pollution. The vulnerability exists via the name argument in the setProperty function at underscore-keypath.js which allows an attacker to inject and modify properties such as __proto__ in the obj parameter resulting in prototype pollution.