Description

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

Remediation

References

https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d

https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467

Related Vulnerabilities

CVE-2014-7191 Vulnerability in maven package org.webjars.bower:qs

CVE-2022-2216 Vulnerability in npm package parse-url

CVE-2022-36095 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2020-15841 Vulnerability in maven package com.liferay:com.liferay.portal.settings.authentication.ldap.web

CVE-2022-31051 Vulnerability in npm package semantic-release

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Exploit NVD-CWE-noinfo