The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Jul 3, 2018 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Feb 24, 2021 | Jul 3, 2018 |
| Debian | — | Upgrade node-deep-extend | Jul 30, 2024 | Jul 3, 2018 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsNo solution existsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade npm | Feb 24, 2021 | Jul 3, 2018 |
| Rocky_linux | — | — | Aug 15, 2024 | Jul 3, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub