Description

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.

Remediation

References

https://github.com/js-data/js-data/blob/master/src/utils.js%23L417

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1050978

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050979

https://snyk.io/vuln/SNYK-JS-JSDATA-1023655

Related Vulnerabilities

CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common

CVE-2022-0639 Vulnerability in npm package url-parse

CVE-2018-3771 Vulnerability in npm package statics-server

CVE-2021-32769 Vulnerability in maven package io.micronaut:micronaut-core

CVE-2021-23470 Vulnerability in npm package putil-merge

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory NVD-CWE-Other