Lucene search
Veracode Vulnerability DatabaseVERACODE:37646HistoryOct 21, 2022 - 3:21 p.m.
Prototype Pollution
2022-10-2115:21:58
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
prototype pollution
defnode function
ast.js
malicious property
software
0.006 Low
EPSS
Percentile
78.7%
uglify-js is vulnerable to prototype pollution. The vulnerability exists in DEFNODE function of ast.js via the name variable which allows an attacker to inject malicious property resulting in prototype pollution.
References
github.com/advisories/GHSA-wx5g-37jh-9gcr
github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46
github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79
github.com/mishoo/UglifyJS/issues/5699
github.com/mishoo/UglifyJS/issues/5721#issuecomment-1292849604
Related
nvd
nvd
CVE-2022-37598
2022-10-20 11:15:10
redhatcve
redhatcve
CVE-2022-37598
2022-11-14 06:26:52
cve
cve
CVE-2022-37598
2022-10-20 11:15:10
debiancve
debiancve
CVE-2022-37598
2022-10-20 11:15:10
cvelist
cvelist
CVE-2022-37598
2022-10-20 00:00:00
vulnrichment
vulnrichment
CVE-2022-37598
2022-10-20 00:00:00
prion
prion
Code injection
2022-10-20 11:15:00
ubuntucve
ubuntucve
CVE-2022-37598
2022-10-20 00:00:00
