CVE-2023-0842

Katalog CVE

CVSS 5.3 · Medium EPSS 1,4%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada xml2js project xml2js. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

Rincian

Terbit di NVD

5 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://fluidattacks.com/advisories/myers/ exploit · advisory pihak ketiga
• https://github.com/Leonidas-from-XIV/node-xml2js/ product
• https://github.com/Leonidas-from-XIV/node-xml2js/releases/tag/0.6.2
• https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html