CVE-2020-7792

Katalog CVE

CVSS 7.5 · High EPSS 2,1%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada moutjs mout. Skor CVSS 3.1 7.5 (High) menurut snyk.io.

Deskripsi (NVD)

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.

Rincian

Terbit di NVD

11 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mout/mout/blob/master/src/object/deepFillIn.js exploit · advisory pihak ketiga
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.js exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1050374 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050373 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-MOUT-1014544 exploit · advisory pihak ketiga