CVE-2023-26132

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada dottie project dottie. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file.

Rincian

Terbit di NVD

10 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mickhansen/dottie.js/commit/7d3aee1c9c3c842720506e131de7e181e5c8db68 patch
• https://security.snyk.io/vuln/SNYK-JS-DOTTIE-3332763 exploit · advisory pihak ketiga
• https://github.com/mickhansen/dottie.js/blob/b48e22714aae4489ea6276452f22cc61980ba5a4/dottie.js%23L107 broken link