CVE-2019-10808: Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify
Summary
CVE-2019-10808: Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify. Affects utilitify versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
utilitify is an npm package that provides utility functions for manipulating objects. It is vulnerable to an issue that allows modification of object properties. The merge method in utilitify can be tricked into adding or modifying properties of the Object.prototype.
Vulnerability Detail
The vulnerability in utilitify prior to version 1.0.3 arises from improper control over dynamically-determined object attributes. This can lead to unauthorized modification of object properties, potentially resulting in security breaches or unexpected behavior. The issue has a CVSS score of 8.8, indicating a high severity level. The vulnerability was published on May 7, 2021, and affects utilitify versions prior to 1.0.3.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
npm install utilitify@1.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
In conclusion, utilitify prior to version 1.0.3 is vulnerable to unauthorized modification of object properties. It is recommended to update to version 1.0.3 or later to mitigate this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for utilitify →
FAQ
utilitify is an npm package that provides utility functions for manipulating objects.
This vulnerability allows unauthorized modification of object properties, which can lead to security breaches or unexpected behavior.
To fix this vulnerability, update utilitify to version 1.0.3 or later.
No specific workaround is mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
The severity of this vulnerability is rated as high, with a CVSS score of 8.8.
