Lucene search

GitHub Advisory DatabaseGHSA-6HWH-RQWF-CXXR

HistoryMay 07, 2021 - 4:32 p.m.

Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util

2021-05-0716:32:02

CWE-20

CWE-915

CWE-1321

GitHub Advisory Database

github.com

vega-util

manipulation

object prototype

vega.mergeconfig

software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

Affected configurations

Vulners

Node

vega_projectvegaRange<1.13.1node.js

VendorProductVersionCPE
vega_projectvega*cpe:2.3:a:vega_project:vega:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
vega_project	vega	*	cpe:2.3:a:vega_project:vega::::::node.js::*

References

github.com/advisories/GHSA-6hwh-rqwf-cxxr

github.com/vega/vega/commit/8f33a0b5170d7de4f12fc248ec0901234342367b

nvd.nist.gov/vuln/detail/CVE-2019-10806

snyk.io/vuln/SNYK-JS-VEGAUTIL-559223

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.4%

JSON

Related for GHSA-6HWH-RQWF-CXXR