CVE-2020-7736: Prototype Pollution in bmoor
Summary
CVE-2020-7736: Prototype Pollution in bmoor. Affects bmoor versions < 0.8.12. Fixed in 0.8.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bmoor package is an npm package that provides various utility functions and classes for JavaScript applications. It is commonly used for data manipulation, validation, and other common tasks. The package is vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service.
Vulnerability Detail
The vulnerability in bmoor arises from the 'set' function, which is susceptible to Prototype Pollution. By manipulating the input to the 'set' function, an attacker can modify the prototype of an object and inject malicious properties or methods. This can result in unexpected behavior or security breaches when the affected object is used elsewhere in the application. The impact of this vulnerability depends on how the modified object is utilized and can range from minor issues to severe security risks.
How To Fix
Minimum fixed version
0.8.12
This is the first release that contains the fix.
npm install bmoor@0.8.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bmoor package is vulnerable to Prototype Pollution, which can result in various security issues. It is crucial to update the package to version 0.8.12 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, you can contact DevNack.com. Vulert (https://vulert.com) is a tool that can help monitor and alert in real-time for open-source vulnerabilities, including this one.
See every vulnerability recorded for bmoor →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to security issues such as remote code execution, information disclosure, or denial of service.
The 'set' function in bmoor is vulnerable to Prototype Pollution because it does not properly sanitize or validate the input. An attacker can manipulate the input to modify the prototype of an object and inject malicious properties or methods.
The consequences of this vulnerability depend on how the modified object is utilized in the application. It can lead to unexpected behavior, security breaches, or exploitation of other vulnerabilities. The impact can range from minor issues to severe security risks.
Yes, the vulnerability can be fixed by updating the bmoor package to version 0.8.12 or later. This version includes a fix for the Prototype Pollution issue. It is recommended to update the package as soon as possible.
To update the bmoor package to version 0.8.12 or later, you can run the following command in your project directory: npm install bmoor@0.8.12
Related vulnerabilities
Recent vulnerabilities recorded for bmoor.
