Description

In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.

Remediation

References

https://github.com/casperjs/casperjs/blob/master/modules/utils.js%23L680

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-572804

https://snyk.io/vuln/SNYK-JS-CASPERJS-572803

Related Vulnerabilities

CVE-2020-7606 Vulnerability in npm package docker-compose-remote-api

CVE-2023-29525 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui

CVE-2011-4367 Vulnerability in maven package org.apache.myfaces.core:myfaces-core-project

CVE-2020-12827 Vulnerability in maven package org.webjars.npm:mjml

CVE-2020-26237 Vulnerability in maven package org.webjars.bowergithub.highlightjs:highlight.js

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Mitigation Third Party Advisory