CVE-2020-7701: Prototype Pollution in madlib-object-utils
Summary
CVE-2020-7701: Prototype Pollution in madlib-object-utils. Affects madlib-object-utils versions < 0.1.7. Fixed in 0.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
madlib-object-utils is an npm package that provides utility functions for working with JavaScript objects. It is used to manipulate and modify object properties in various ways. However, versions before 0.1.7 are vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to various security issues, including remote code execution, data tampering, and privilege escalation.
Vulnerability Detail
The vulnerability in madlib-object-utils arises from the setValue function, which is susceptible to Prototype Pollution. By manipulating the input to this function, an attacker can modify the prototype of an object and inject malicious properties or methods. This can have severe consequences, as it allows the attacker to execute arbitrary code, tamper with data, or escalate privileges within the application. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
0.1.7
This is the first release that contains the fix.
npm install madlib-object-utils@0.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible.
Conclusion
In conclusion, madlib-object-utils versions before 0.1.7 are vulnerable to Prototype Pollution. This can lead to severe security issues, including remote code execution and data tampering. It is crucial to update to version 0.1.7 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for madlib-object-utils →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to various security issues.
The impact of this vulnerability can be severe, including remote code execution, data tampering, and privilege escalation.
To fix this vulnerability, update madlib-object-utils to version 0.1.7 or later.
There is no known workaround for this vulnerability. It is essential to update to the fixed version.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for madlib-object-utils.
