CVE-2018-16491

Опубликовано: 01 фев. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

Ссылки

https://hackerone.com/reports/430831
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/430831
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:dreamerslab:node.extend:*:*:*:*:*:node.js:*:*

Версия до 1.1.7 (исключая)

cpe:2.3:a:dreamerslab:node.extend:*:*:*:*:*:node.js:*:*

Версия от 2.0.0 (включая) до 2.0.1 (исключая)

EPSS

Процентиль: 63%

0.00442

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-400

CWE-74

Связанные уязвимости

CVE-2018-16491

CVSS3: 9.8

ubuntu

около 7 лет назад

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

CVE-2018-16491

CVSS3: 4.8

redhat

около 7 лет назад

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

CVE-2018-16491

CVSS3: 9.8

debian

около 7 лет назад

A prototype pollution vulnerability was found in node.extend <1.1.7, ~ ...

GHSA-r96c-57pf-9jjm

CVSS3: 9.8

github

почти 7 лет назад

Prototype Pollution in node.extend

EPSS

Процентиль: 63%

0.00442

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-400

CWE-74