Description

In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

Remediation

References

https://github.com/nasa/openmct/pull/7094/commits/545a1770c523ecc3410dca884c6809d5ff0f9d52

https://nasa.github.io/openmct/

https://www.linkedin.com/pulse/prototype-pollution-nasas-open-mct-cve-2023-45282

https://github.com/nasa/openmct/compare/v3.0.2...v3.1.0

Related Vulnerabilities

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.homematic

CVE-2022-25898 Vulnerability in maven package org.webjars.bower:jsrsasign

CVE-2023-35151 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rest-server

CVE-2019-10742 Vulnerability in maven package org.webjars.npm:axios

CVE-2020-15131 Vulnerability in npm package slp-validate

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Patch Product Third Party Advisory