Lucene search

Veracode Vulnerability DatabaseVERACODE:48298

HistoryAug 01, 2024 - 7:26 a.m.

Prototype Pollution

2024-08-0107:26:07

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prototype pollution

vulnerability

denial of service

remote code execution

cross-site scripting

software

helpers.restorestate

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

@ais-ltd/strategyen is vulnerable to prototype pollution. The vulnerability is due to passing arguments with the built-in property proto to the function helpers.restoreState, which allows attackers to alter object behavior and potentially lead to Denial of Service, remote code execution, or cross-site scripting attacks.

References

gist.github.com/mestrtee/acfbd724a4b73bfb5d030575b653453c

github.com/advisories/GHSA-26mh-xhv7-944g

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

43.7%

JSON

Related for VERACODE:48298