CVE-2020-7714: Prototype Pollution in confucious
Summary
CVE-2020-7714: Prototype Pollution in confucious. Affects confucious versions < 0.0.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Confucious is an npm package that provides functionality for managing configurations. It allows users to set and retrieve configuration values. The package is vulnerable to Prototype Pollution through its set function.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can inject properties into existing objects. In the case of confucious, the set function does not properly validate user input, allowing an attacker to modify the prototype of the configuration object. This can lead to various security issues, such as remote code execution or privilege escalation. The vulnerability affects all versions of confucious up to and including version 0.0.12.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to a patched version of confucious to mitigate the risk.
Conclusion
The vulnerability in confucious allows for Prototype Pollution, which can have severe security implications. It is crucial to update to a patched version of confucious (0.0.13 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for confucious →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to inject properties into existing objects, potentially leading to security issues.
The vulnerability in confucious can allow an attacker to modify the prototype of the configuration object, which can lead to remote code execution or privilege escalation.
All versions of confucious up to and including version 0.0.12 are vulnerable to this issue.
Yes, the maintainers of confucious have released a patch to address the vulnerability. Users should upgrade to version 0.0.13 or later.
There are no known workarounds for this vulnerability. It is essential to update to a patched version of confucious.
