Vulnerabilites related to HackerOne - mixin-deep node module
cve-2018-3719
Vulnerability from cvelistv5
Published
2018-06-07 02:00
Modified
2024-09-17 04:19
Severity ?
EPSS score ?
Summary
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
References
▼ | URL | Tags |
---|---|---|
https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c | x_refsource_MISC | |
https://hackerone.com/reports/311236 | x_refsource_MISC |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
HackerOne | mixin-deep node module |
Version: Versions before 1.3.1 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T04:50:30.481Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://hackerone.com/reports/311236", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "mixin-deep node module", vendor: "HackerOne", versions: [ { status: "affected", version: "Versions before 1.3.1", }, ], }, ], datePublic: "2018-04-26T00:00:00", descriptions: [ { lang: "en", value: "mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-471", description: "Modification of Assumed-Immutable Data (MAID) (CWE-471)", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2018-06-07T01:57:01", orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", shortName: "hackerone", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c", }, { tags: [ "x_refsource_MISC", ], url: "https://hackerone.com/reports/311236", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "support@hackerone.com", DATE_PUBLIC: "2018-04-26T00:00:00", ID: "CVE-2018-3719", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "mixin-deep node module", version: { version_data: [ { version_value: "Versions before 1.3.1", }, ], }, }, ], }, vendor_name: "HackerOne", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Modification of Assumed-Immutable Data (MAID) (CWE-471)", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c", refsource: "MISC", url: "https://github.com/jonschlinkert/mixin-deep/commit/578b0bc5e74e14de9ef4975f504dc698796bdf9c", }, { name: "https://hackerone.com/reports/311236", refsource: "MISC", url: "https://hackerone.com/reports/311236", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1", assignerShortName: "hackerone", cveId: "CVE-2018-3719", datePublished: "2018-06-07T02:00:00Z", dateReserved: "2017-12-28T00:00:00", dateUpdated: "2024-09-17T04:19:14.237Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }