Description

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Remediation

References

https://hackerone.com/reports/310446

Related Vulnerabilities

CVE-2017-1000190 Vulnerability in maven package org.simpleframework:simple-xml

CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common

CVE-2023-37958 Vulnerability in maven package org.jenkins-ci.plugins:sumologic-publisher

CVE-2023-40350 Vulnerability in maven package org.jenkins-ci.plugins:docker-swarm

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

Severity

Critical

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Issue Tracking Third Party Advisory