Description

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

Remediation

References

https://hackerone.com/reports/380878

Related Vulnerabilities

CVE-2023-43123 Vulnerability in maven package org.apache.storm:storm-server

CVE-2021-44684 Vulnerability in npm package github-todos

CVE-2020-35210 Vulnerability in maven package io.atomix:atomix

CVE-2023-30515 Vulnerability in maven package io.jenkins.plugins:thycotic-devops-secrets-vault

CVE-2021-33813 Vulnerability in maven package org.jdom:jdom

Severity

Critical

Classification

CWE-74 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory