ghsa-g954-5hwp-pp24
Vulnerability from github
Published
2022-05-28 00:00
Modified
2022-08-17 15:36
Severity ?
Summary
Prototype Pollution in protobufjs
Details
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.
This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
{
"affected": [
{
"ecosystem_specific": {
"affected_functions": [
"(protobufjs).util.setProperty"
]
},
"package": {
"ecosystem": "npm",
"name": "protobufjs"
},
"ranges": [
{
"events": [
{
"introduced": "6.11.0"
},
{
"fixed": "6.11.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"ecosystem_specific": {
"affected_functions": [
"(protobufjs).util.setProperty"
]
},
"package": {
"ecosystem": "npm",
"name": "protobufjs"
},
"ranges": [
{
"events": [
{
"introduced": "6.10.0"
},
{
"fixed": "6.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25878"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-02T20:36:05Z",
"nvd_published_at": "2022-05-27T20:15:00Z",
"severity": "HIGH"
},
"details": "The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.\n\nThis vulnerability can occur in multiple ways:\n1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions\n2. by parsing/loading .proto files\n\n\n",
"id": "GHSA-g954-5hwp-pp24",
"modified": "2022-08-17T15:36:47Z",
"published": "2022-05-28T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25878"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/pull/1731"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/pull/1735"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f"
},
{
"type": "PACKAGE",
"url": "https://github.com/protobufjs/protobuf.js"
},
{
"type": "WEB",
"url": "https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in protobufjs"
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.