CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
855 vulnerabilities reference this CWE, most recent first.
GHSA-M2RR-82CC-GH7R
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-02-06 18:31A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
{
"affected": [],
"aliases": [
"CVE-2024-57065"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-05T22:15:30Z",
"severity": "HIGH"
},
"details": "A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.",
"id": "GHSA-m2rr-82cc-gh7r",
"modified": "2025-02-06T18:31:05Z",
"published": "2025-02-06T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57065"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/7b2c50ccdec39a030091e48a4ccde688"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M3R7-WX5J-GX67
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-03 18:47jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
{
"affected": [],
"aliases": [
"CVE-2024-38998"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T13:15:05Z",
"severity": "HIGH"
},
"details": "jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"id": "GHSA-m3r7-wx5j-gx67",
"modified": "2024-07-03T18:47:30Z",
"published": "2024-07-01T15:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38998"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M428-JQC4-2P5J
Vulnerability from github – Published: 2021-05-06 17:28 – Updated: 2021-05-05 21:46All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "phpjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7700"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T21:46:10Z",
"nvd_published_at": "2020-08-14T15:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)",
"id": "GHSA-m428-jqc4-2p5j",
"modified": "2021-05-05T21:46:10Z",
"published": "2021-05-06T17:28:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7700"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PHPJS-598681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in phpjs"
}
GHSA-M4GQ-X24J-JPMF
Vulnerability from github – Published: 2024-10-22 18:17 – Updated: 2024-10-23 14:24The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.
This affects the built:
dist/mermaid.min.jsdist/mermaid.jsdist/mermaid.esm.mjsdist/mermaid.esm.min.mjs
This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js
Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix.
Patches
developbranch: 6c785c93166c151d27d328ddf68a13d9d65adc00- backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 10.9.2"
},
"package": {
"ecosystem": "npm",
"name": "mermaid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-1395"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-22T18:17:02Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.\n\nThis affects the built:\n\n- `dist/mermaid.min.js`\n- `dist/mermaid.js`\n- `dist/mermaid.esm.mjs`\n- `dist/mermaid.esm.min.mjs`\n\nThis will also affect users that use the above files via a CDN link, e.g. `https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js`\n\n**Users that use the default NPM export of `mermaid`, e.g. `import mermaid from \u0027mermaid\u0027`, or the `dist/mermaid.core.mjs` file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like `npm audit fix`.**\n\n### Patches\n\n- `develop` branch: 6c785c93166c151d27d328ddf68a13d9d65adc00\n- backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34",
"id": "GHSA-m4gq-x24j-jpmf",
"modified": "2024-10-23T14:24:24Z",
"published": "2024-10-22T18:17:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674"
},
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-m4gq-x24j-jpmf"
},
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/commit/6c785c93166c151d27d328ddf68a13d9d65adc00"
},
{
"type": "WEB",
"url": "https://github.com/mermaid-js/mermaid/commit/92a07ffe40aab2769dd1c3431b4eb5beac282b34"
},
{
"type": "PACKAGE",
"url": "https://github.com/mermaid-js/mermaid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution vulnerability found in Mermaid\u0027s bundled version of DOMPurify"
}
GHSA-M56H-5XX3-2JC2
Vulnerability from github – Published: 2024-12-18 15:50 – Updated: 2025-01-07 15:12Summary
jsii is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library.
When loaded as a library into a larger application, prototype pollution may happen if untrusted user input is passed to the library. When used as a command line-tool, this pollution cannot occur.
Impact
You may be impacted if you have written an application that loads jsii as a library, and passes untrusted user input into the jsii.configureCategories() function. In that case, a user can craft input in such a way that, following the invocation, a field named "category" with a user-controlled value is added to the JavaScript Object prototype. This will cause every object in the program (both new and existing) to have a field named "category", even if it shouldn't.
This will not affect jsii itself, but it might affect the application you have loaded jsii into.
The function
jsii.configureCategories()is used to configure the severity (error, warning, etc.) of various jsii diagnostics.
Impacted versions: <=5.7.2, <=5.6.3, <=5.5.14, <=5.4.45
Example:
const jsii = require('jsii');
// prints 'undefined'
console.log(JSON.stringify({}.category))
// calling 'configureCategories' with user input
jsii.configureCategories(JSON.parse('{"__proto__": "user-input"}'))
// from this point onwards, every single object literal in the program
// will contain the 'category' key, with user controlled value
console.log(JSON.stringify({}.category)) // prints 'user-input'
// this can affect the execution of the main program in case it also makes
// use of an object key called 'category'. for example, if the main programs
// happens to have code like this:
const x = {} // some object in the main program (not necessarily empty)
if (x.category) {
// this block will always be executed, effectively
// changing the behavior of the main program.
console.log('Do something')
} else {
console.log('Do something else')
}
For more information about javascript prototype pollution, see [1].
Patches
A patch is included in versions 5.7.3, 5.6.4, 5.5.15, 5.4.46
Workarounds
Sanitize user input to configureCategories() by stripping the proto property if detected.
References
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our issue reporting page [2] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
[1] https://learn.snyk.io/lesson/prototype-pollution/
[2] https://aws.amazon.com/security/issue-reporting
Credits
We would like to thank Tariq Hawis for collaborating on this issue through the coordinated vulnerability disclosure process.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsii"
},
"ranges": [
{
"events": [
{
"introduced": "5.7.0"
},
{
"fixed": "5.7.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "jsii"
},
"ranges": [
{
"events": [
{
"introduced": "5.6.0"
},
{
"fixed": "5.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "jsii"
},
"ranges": [
{
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.5.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "jsii"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.0"
},
{
"fixed": "5.4.46"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-18T15:50:09Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "## Summary\n\n`jsii` is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library.\nWhen loaded as a library into a larger application, prototype pollution may happen if untrusted user input is passed to the library. When used as a command line-tool, this pollution cannot occur.\n\n## Impact\n\nYou may be impacted if you have written an application that loads jsii as a library, and passes untrusted user input into the `jsii.configureCategories()` function. In that case, a user can craft input in such a way that, following the invocation, a field named \"category\" with a user-controlled value is added to the JavaScript Object prototype. This will cause every object in the program (both new and existing) to have a field named \"category\", even if it shouldn\u0027t. \n\n**This will not affect jsii itself, but it might affect the application you have loaded jsii into.**\n\n\u003e The function `jsii.configureCategories()` is used to configure the severity (error, warning, etc.) of various jsii diagnostics.\n\n**Impacted versions: \u003c=5.7.2, \u003c=5.6.3, \u003c=5.5.14, \u003c=5.4.45** \n\n**Example:**\n\n```js\nconst jsii = require(\u0027jsii\u0027);\n\n// prints \u0027undefined\u0027\nconsole.log(JSON.stringify({}.category))\n\n// calling \u0027configureCategories\u0027 with user input\njsii.configureCategories(JSON.parse(\u0027{\"__proto__\": \"user-input\"}\u0027))\n\n// from this point onwards, every single object literal in the program\n// will contain the \u0027category\u0027 key, with user controlled value\nconsole.log(JSON.stringify({}.category)) // prints \u0027user-input\u0027\n\n\n// this can affect the execution of the main program in case it also makes \n// use of an object key called \u0027category\u0027. for example, if the main programs \n// happens to have code like this:\n\nconst x = {} // some object in the main program (not necessarily empty)\n\nif (x.category) {\n // this block will always be executed, effectively \n // changing the behavior of the main program.\n console.log(\u0027Do something\u0027)\n} else {\n console.log(\u0027Do something else\u0027)\n}\n```\n\nFor more information about javascript prototype pollution, see [1].\n\n## Patches\n\nA patch is included in versions [5.7.3](https://github.com/aws/jsii-compiler/releases/tag/v5.7.3), [5.6.4](https://github.com/aws/jsii-compiler/releases/tag/v5.6.4), [5.5.15](https://github.com/aws/jsii-compiler/releases/tag/v5.5.15), [5.4.46](https://github.com/aws/jsii-compiler/releases/tag/v5.4.46)\n\n## Workarounds\n\nSanitize user input to configureCategories() by stripping the __proto__ property if detected.\n\n## References\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our issue reporting page [2] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://learn.snyk.io/lesson/prototype-pollution/\n\n[2] [https://aws.amazon.com/security/issue-reporting](https://aws.amazon.com/security/vulnerability-reporting)\n\n## Credits\n\nWe would like to thank _Tariq Hawis_ for collaborating on this issue through the coordinated vulnerability disclosure process.",
"id": "GHSA-m56h-5xx3-2jc2",
"modified": "2025-01-07T15:12:20Z",
"published": "2024-12-18T15:50:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aws/jsii-compiler/security/advisories/GHSA-m56h-5xx3-2jc2"
},
{
"type": "PACKAGE",
"url": "https://github.com/aws/jsii-compiler"
},
{
"type": "WEB",
"url": "https://github.com/aws/jsii-compiler/releases/tag/v5.4.46"
},
{
"type": "WEB",
"url": "https://github.com/aws/jsii-compiler/releases/tag/v5.5.15"
},
{
"type": "WEB",
"url": "https://github.com/aws/jsii-compiler/releases/tag/v5.6.4"
},
{
"type": "WEB",
"url": "https://github.com/aws/jsii-compiler/releases/tag/v5.7.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in jsii.configureCategories"
}
GHSA-M5XM-MX43-Q65F
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary file system read in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2026-34626"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T17:16:51Z",
"severity": "MODERATE"
},
"details": "Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) vulnerability that could result in arbitrary file system read in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-m5xm-mx43-q65f",
"modified": "2026-04-14T18:30:36Z",
"published": "2026-04-14T18:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34626"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb26-44.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M639-9WHG-FW97
Vulnerability from github – Published: 2022-02-19 00:01 – Updated: 2022-02-28 22:17The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "object-extend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23702"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-22T20:51:50Z",
"nvd_published_at": "2022-02-18T20:15:00Z",
"severity": "CRITICAL"
},
"details": "The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.",
"id": "GHSA-m639-9whg-fw97",
"modified": "2022-02-28T22:17:42Z",
"published": "2022-02-19T00:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23702"
},
{
"type": "PACKAGE",
"url": "https://github.com/bernhardw/object-extend"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-OBJECTEXTEND-2401470"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in object-extend"
}
GHSA-M6MG-JVJF-W44X
Vulnerability from github – Published: 2022-07-26 00:01 – Updated: 2022-08-04 21:25This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "conf-cfg-ini"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28441"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-04T21:25:33Z",
"nvd_published_at": "2022-07-25T14:15:00Z",
"severity": "CRITICAL"
},
"details": "This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.",
"id": "GHSA-m6mg-jvjf-w44x",
"modified": "2022-08-04T21:25:33Z",
"published": "2022-07-26T00:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28441"
},
{
"type": "WEB",
"url": "https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea"
},
{
"type": "WEB",
"url": "https://github.com/loge5/conf-cfg-ini/commit/ecd878f8f7398e765739e989c7fe7cc052308947"
},
{
"type": "PACKAGE",
"url": "https://github.com/loge5/conf-cfg-ini"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2"
}
GHSA-M7J4-FHG6-XF5V
Vulnerability from github – Published: 2020-12-17 21:00 – Updated: 2024-06-21 21:33All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "datatables.net"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28458"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2020-12-17T18:27:07Z",
"nvd_published_at": "2020-12-16T11:15:00Z",
"severity": "HIGH"
},
"details": "All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.",
"id": "GHSA-m7j4-fhg6-xf5v",
"modified": "2024-06-21T21:33:49Z",
"published": "2020-12-17T21:00:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28458"
},
{
"type": "WEB",
"url": "https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03"
},
{
"type": "PACKAGE",
"url": "https://github.com/DataTables/DataTablesSrc"
},
{
"type": "WEB",
"url": "https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0006"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "datatables.net vulnerable to Prototype Pollution due to incomplete fix"
}
GHSA-M7MV-M566-78J6
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2022-08-20 00:00A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions.
{
"affected": [],
"aliases": [
"CVE-2022-2625"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-913",
"CWE-915"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there\u0027s no need to modify individual extensions.",
"id": "GHSA-m7mv-m566-78j6",
"modified": "2022-08-20T00:00:39Z",
"published": "2022-08-19T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2625"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-2625"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2113825"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202211-04"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-beta-3-released-2496"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.