Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:47860
HistoryJul 02, 2024 - 7:13 a.m.

Prototype Pollution

2024-07-0207:13:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
prototype pollution
@jsonic/jsonic-next
vulnerability
improper handling
inputs
attackers
object.prototype
denial of service
arbitrary code execution

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.3

Confidence

High

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to the functions empty, util.clone, util.prop, util.deep, and make not properly handling inputs containing the special property __proto__. Attackers can exploit this to modify the built-in Object.prototype, potentially leading to Denial of Service or arbitrary code execution.

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.3

Confidence

High

Related for VERACODE:47860