The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Jul 3, 2018 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-nodemon | Feb 24, 2021 | Jul 3, 2018 |
| Debian | — | Upgrade node-deep-extend | Jul 30, 2024 | Jul 3, 2018 |
| Redhat_linux | — | Upgrade nodejs-debuginfoNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-devel | Feb 24, 2021 | Jul 3, 2018 |
| Rocky_linux | — | — | Aug 15, 2024 | Jul 3, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub