The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Jul 3, 2018 |
| Centos_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18n | Feb 24, 2021 | Jul 3, 2018 |
| Debian | — | Upgrade node-deep-extend | Jul 30, 2024 | Jul 3, 2018 |
| Redhat_linux | — | No solution existsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-devel | Feb 24, 2021 | Jul 3, 2018 |
| Rocky_linux | — | — | Aug 15, 2024 | Jul 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub