CVE-2022-31106

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada clever underscore.deep. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.

Rincian

Terbit di NVD

28 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7 patch · advisory pihak ketiga
• https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm exploit · issue tracking · patch · advisory pihak ketiga