Описание
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
A flaw was found in node-xml2js. This flaw allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, making it possible to edit the proto property.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2 | openshift-service-mesh/kiali-rhel8 | Will not fix | ||
| OpenShift Service Mesh 2.1 | openshift-service-mesh/kiali-rhel8 | Will not fix | ||
| Red Hat A-MQ Online | node-xml2js | Not affected | ||
| Red Hat Data Grid 8 | xml2js | Will not fix | ||
| Red Hat Enterprise Linux 6 | firefox | Out of support scope | ||
| Red Hat Enterprise Linux 7 | firefox | Out of support scope | ||
| Red Hat Enterprise Linux 8 | mozjs60 | Not affected | ||
| Red Hat Enterprise Linux 9 | gjs | Not affected | ||
| Red Hat Enterprise Linux 9 | polkit | Not affected | ||
| Red Hat Fuse 7 | node-xml2js | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
xml2js version 0.4.23 allows an external attacker to edit or add new p ...
Уязвимость программного средства для конвертации XML-объектов в JavaScript xml2js, связанная с неконтролируемым изменением атрибутов прототипа объекта, позволяющая нарушителю редактировать или добавлять новые свойства объекта
EPSS
5.3 Medium
CVSS3