Description

Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.

Remediation

References

https://hackerone.com/reports/801522

Related Vulnerabilities

CVE-2017-16139 Vulnerability in npm package jikes

CVE-2022-36127 Vulnerability in npm package skywalking-backend-js

CVE-2022-45401 Vulnerability in maven package org.jenkinsci.plugins:associated-files

CVE-2022-41249 Vulnerability in maven package com.meowlomo.jenkins:scm-httpclient

CVE-2022-21192 Vulnerability in npm package serve-lite

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory