Description

In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.

Remediation

References

https://github.com/casperjs/casperjs/blob/master/modules/utils.js%23L680

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-572804

https://snyk.io/vuln/SNYK-JS-CASPERJS-572803

Related Vulnerabilities

CVE-2022-25893 Vulnerability in npm package vm2

CVE-2022-28355 Vulnerability in maven package org.scala-js:scalajs-library_2.11

CVE-2021-23330 Vulnerability in npm package launchpad

CVE-2022-34298 Vulnerability in maven package org.openidentityplatform.openam:openam-auth-nt

CVE-2020-7601 Vulnerability in npm package gulp-scss-lint

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Mitigation Third Party Advisory