GHSA-F7QW-5PVG-MMWP中危已审查

Prototype Pollution in lutils-merge

OSV 1.4.0 · github-reviewed · 修改于 2021-08-16 22:36

发布时间

2019-06-14 02:58

GitHub 审查时间

2019-06-14 02:58

NVD 发布时间

—

源文件

advisories/github-reviewed/2019/06/GHSA-f7qw-5pvg-mmwp/GHSA-f7qw-5pvg-mmwp.json

公告说明

All versions of lutils-merge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.

Recommendation

The package is deprecated and no fixes are available. Consider using an alternative package.

受影响的软件包

npm

lutils-merge

ECOSYSTEM

引入00.2.6

标识信息

别名 / CVE

无

CWE

CWE-400

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

原始 OSV JSON

{
  "id": "GHSA-f7qw-5pvg-mmwp",
  "aliases": [],
  "details": "All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.\n\n\n## Recommendation\n\nThe package is deprecated and no fixes are available. Consider using an alternative package.\n",
  "summary": "Prototype Pollution in lutils-merge",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.2.6"
            }
          ]
        }
      ],
      "package": {
        "name": "lutils-merge",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-08-16T14:36:47Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    }
  ],
  "published": "2019-06-13T18:58:44Z",
  "references": [
    {
      "url": "https://github.com/nfour/lutils-merge/issues/1",
      "type": "WEB"
    },
    {
      "url": "https://hackerone.com/reports/439107",
      "type": "WEB"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-LUTILSMERGE-174783",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/advisories/893",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2019-06-13T18:58:27Z"
  }
}