Описание
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
Ссылки
- Broken Link
- PatchThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Broken Link
- PatchThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.0.2 (исключая)
cpe:2.3:a:skratchdot:object-path-set:*:*:*:*:*:*:*:*
EPSS
Процентиль: 65%
0.00502
Низкий
7.5 High
CVSS3
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-1321
Связанные уязвимости
EPSS
Процентиль: 65%
0.00502
Низкий
7.5 High
CVSS3
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-1321