gsd-2019-10744
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-10744",
"description": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"id": "GSD-2019-10744",
"references": [
"https://www.suse.com/security/cve/CVE-2019-10744.html",
"https://access.redhat.com/errata/RHSA-2021:5134",
"https://access.redhat.com/errata/RHSA-2020:2819",
"https://access.redhat.com/errata/RHSA-2020:2362",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://access.redhat.com/errata/RHSA-2022:5101"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-10744"
],
"details": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"id": "GSD-2019-10744",
"modified": "2023-12-13T01:23:57.424291Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"ID": "CVE-2019-10744",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "lodash",
"version": {
"version_data": [
{
"version_value": "All versions prior to 4.17.12"
}
]
}
}
]
},
"vendor_name": "Snyk"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Prototype Pollution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2019:3024",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3024"
},
{
"name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"name": "https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"refsource": "CONFIRM",
"url": "https://snyk.io/vuln/SNYK-JS-LODASH-450202"
},
{
"name": "https://security.netapp.com/advisory/ntap-20191004-0005/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20191004-0005/"
},
{
"name": "https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"refsource": "CONFIRM",
"url": "https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2021.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c4.17.13",
"affected_versions": "All versions before 4.17.13",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.17.13"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.17.13",
"package_slug": "npm/lodash-amd",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.17.13 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "d9547eba-658d-4462-9224-16ecb70f9fca"
},
{
"affected_range": "\u003c4.17.14",
"affected_versions": "All versions before 4.17.14",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.17.14"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.17.14",
"package_slug": "npm/lodash-es",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.17.14 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "c3616d0c-e7d3-427d-87ef-3f64cd0eea48"
},
{
"affected_range": "\u003c4.6.1",
"affected_versions": "All versions before 4.6.1",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.6.1"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.6.1",
"package_slug": "npm/lodash.defaultsdeep",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.6.1 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "b44b8ff7-9f98-4799-b079-7ddebcc80fb5"
},
{
"affected_range": "\u003c4.6.2",
"affected_versions": "All versions before 4.6.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.6.2"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.6.2",
"package_slug": "npm/lodash.merge",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.6.2 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "61a1c16c-47f4-4b19-9e1b-74bf2ed3aef2"
},
{
"affected_range": "\u003c4.6.2",
"affected_versions": "All versions before 4.6.2",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.6.2"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.6.2",
"package_slug": "npm/lodash.mergewith",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.6.2 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "14a5a248-8e25-472d-97ea-9137acf5dfad"
},
{
"affected_range": "\u003c4.5.0",
"affected_versions": "All versions before 4.5.0",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2021-08-17",
"description": "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.",
"fixed_versions": [
"4.5.0"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"GHSA-jf85-cpcp-j695",
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.5.0",
"package_slug": "npm/lodash.template",
"pubdate": "2019-07-10",
"solution": "Upgrade to version 4.5.0 or above.",
"title": "Prototype Pollution in lodash",
"urls": [
"https://github.com/lodash/lodash/pull/4336",
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744",
"https://snyk.io/vuln/SNYK-JS-LODASH-450202",
"https://www.npmjs.com/advisories/1065",
"https://access.redhat.com/errata/RHSA-2019:3024",
"https://security.netapp.com/advisory/ntap-20191004-0005/",
"https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://github.com/advisories/GHSA-jf85-cpcp-j695"
],
"uuid": "ee4ac735-0da2-4b6c-9bde-dc480cbbe713"
},
{
"affected_range": "\u003c4.17.12",
"affected_versions": "All versions before 4.17.12",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2019-10-04",
"description": "lodash is vulnerable to Prototype Pollution. The function `defaultsDeep` could be tricked into adding or modifying properties of `Object.prototype` using a constructor payload.",
"fixed_versions": [
"4.17.12"
],
"identifier": "CVE-2019-10744",
"identifiers": [
"CVE-2019-10744"
],
"not_impacted": "All versions starting from 4.17.12",
"package_slug": "npm/lodash",
"pubdate": "2019-07-25",
"solution": "Upgrade to version 4.17.12 or above.",
"title": "Improper Input Validation",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-10744"
],
"uuid": "4774cd67-936f-419e-8533-ae5cfe7db9f9"
}
]
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "5C21E48F-F34A-4124-9EF1-C106EB3B2209",
"versionEndExcluding": "4.17.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
"matchCriteriaId": "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
"matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
"matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7081652A-D28B-494E-94EF-CA88117F23EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "9FA1A18F-D997-4121-A01B-FD9B3BF266CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EABAFD73-150F-4DFE-B721-29EB4475D979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DE57039D-E2EE-4014-A7B1-D7380D26098E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0532FA-7B7B-46B3-AB10-0920034A7E43",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "592327AA-BCC4-4CD0-82C6-EA739F049E82",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2980BE62-6B8C-4E2A-B4EF-38A23E1CCD21",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E9170095-A9BB-4D24-9925-39256D7CE2C6",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "56414352-0A79-4ED2-B670-D7CC9508FA9D",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3B3DCE49-C37D-4951-AB57-7CDDEBA1C1E5",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3DD78D19-D17E-45EC-98C7-74D086AE68AA",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "322E6570-185C-4413-A7CE-674CBAE95D05",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B59E16D-7645-492A-9C1D-A8724FFCA28F",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0BA6818C-DCCE-4347-935A-CE6BA0014CDE",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5D5AA99B-08E7-4959-A3B4-41AA527B4B22",
"versionEndIncluding": "12.1.5",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4AC8FD5C-AE1A-4484-BB6F-EBB6A48D21F8",
"versionEndIncluding": "13.1.3",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC15881B-9C49-4E77-9FB6-A6E60D0BCAD3",
"versionEndIncluding": "14.1.2",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D29F60E2-E39D-46E8-935E-8E0A0D32E262",
"versionEndExcluding": "15.0.1.3",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F302F7BC-A08A-4DB3-A257-699C7DBDCAB0",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5D3F7911-FB00-4612-9109-9E7A407BC7B7",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B547F46F-5563-4E7F-8B69-3D25C6C58521",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78753BD2-6631-459D-AD89-0FE2C0F3FDD5",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "997D12F1-098D-4C42-A6A2-B4F59AC78F0F",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45920B7E-10A6-4066-87AB-60D584689891",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "91BF72A9-EB50-4315-B956-5926967DCC46",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4AEE0B76-3F8E-420A-9589-BF3FDB942DEB",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA9E370F-2A37-4612-91DD-2B1FD7EECCE7",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6C4B56F-D022-4268-9D78-6E4D12AE9215",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "53CA3EC2-CE36-4388-A7A9-4311AD80A8B2",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5043F299-FEE6-4878-8616-D2976FAC2BDF",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E59859F8-3BF6-4BE3-8E4B-DF3B68303B22",
"versionEndIncluding": "13.1.3",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "024C7911-8C97-4A94-8F0B-18BE2109A499",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9E14CCF2-E795-4763-A560-2C54C55619BE",
"versionEndExcluding": "15.1.1",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73EC8EDA-669A-4750-934F-3B3FBF557080",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7917031-0735-483C-A8DA-11430056D568",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E10BF5A-2BD0-4791-B842-358968AFC9E6",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EAFC0D83-7F64-44F2-A014-37DE3CAF846A",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6419B4B3-DE7A-4B72-BFFC-6C646AC07BB7",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C3C6E77-BB41-48AA-AFEA-8C6F18BE7025",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "156F3B54-1827-4048-AACD-835092853943",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "206B46BD-846A-493C-BC83-531E6CD45F5A",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC1CC599-DA9C-46BD-9C5C-FD25D57AE9D6",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C00CAEFA-C255-4C0B-8DE1-12686EC7D09B",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A0581EEF-98E6-4961-8178-BA2D7647F931",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FFC5C221-AE58-4580-876A-E5FD7970A695",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "27A9FAF9-7198-41FD-B093-AE11DD5AD67B",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "920BC3DD-A1D4-403B-83D2-00636C20FFC0",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2BDD592C-6DBC-4A35-8483-ACC471FF92E3",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32773569-67FE-4F08-A613-E507FCDEACEF",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "463AA399-492A-4DB6-BFD1-31725012AE8F",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94F1100B-0EE4-41A7-AD34-336D4335751D",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "49C8BE4A-DED6-451A-B6EE-AC95DD26F85A",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B3087972-862F-4A0D-9D9D-38BAB9D383F4",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4494F771-4026-478C-8004-B162653DC80C",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98314370-E3C8-4CB5-9F48-57004EB96D8F",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "929E75AD-5DC4-4992-A589-BA4516BC38FA",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC0E30F-6550-4BC9-8DA7-6BD495DBF415",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45641A58-0B5B-48C6-B0A3-0822A86A00AC",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A97489DC-A5DE-48AD-BBA2-F9078070F53A",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FBF128B7-874B-4E3A-B52F-1C2DE34F64A9",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50AB72FA-552D-4B37-9C58-B4AB3B7B989A",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D5D90F4A-FA2A-412F-8591-D1CA6399ECAD",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B5F9367-89D5-4D7D-A0FE-6C289E0A606C",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1EDB944B-DF60-45AF-AD60-33E9667E0D12",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "20C58940-C7A3-47A9-8C9E-7B652E4F4750",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA5A4B1B-F4F0-4053-8756-2C84AA885060",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BAD2867D-D646-4B01-A383-6A47B51D059E",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C50229-3A95-4AA8-A720-4D35FF482DC3",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "02CB8916-A9ED-4935-BFBD-5C9E8D45379E",
"versionEndExcluding": "12.1.5.2",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5853A161-2F92-4298-A70A-03A66DED157C",
"versionEndExcluding": "13.1.3.4",
"versionStartIncluding": "13.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A86EF843-B0CB-4FB0-9E0A-51F7DD3BD44B",
"versionEndExcluding": "14.1.2.5",
"versionStartIncluding": "14.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "126DC4FA-E5EB-43E1-83F9-19F29E852E03",
"versionEndExcluding": "15.0.1.4",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0064DE79-D6D6-4AE0-BF10-BF91FF9158DF",
"versionEndExcluding": "15.1.0.2",
"versionStartIncluding": "15.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F37D18F2-8C6A-4557-85DC-2A751595423C",
"versionEndIncluding": "6.1.0",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A5C1DACF-0562-4A41-A9EC-60D1DC065007",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2B589C35-55F2-4D40-B5A6-8267EE20D627",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D3CE7526-9630-48EF-81FB-44904AF0653F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload."
},
{
"lang": "es",
"value": "Las versiones de lodash inferiores a 4.17.12, son vulnerables a la Contaminaci\u00f3n de Prototipo. La funci\u00f3n defaultsDeep podr\u00eda ser enga\u00f1ada para agregar o modificar las propiedades de Object.prototype usando una carga \u00fatil de constructor."
}
],
"id": "CVE-2019-10744",
"lastModified": "2024-01-21T02:45:24.433",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-07-26T00:15:11.217",
"references": [
{
"source": "report@snyk.io",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3024"
},
{
"source": "report@snyk.io",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20191004-0005/"
},
{
"source": "report@snyk.io",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://snyk.io/vuln/SNYK-JS-LODASH-450202"
},
{
"source": "report@snyk.io",
"tags": [
"Third Party Advisory"
],
"url": "https://support.f5.com/csp/article/K47105354?utm_source=f5support\u0026amp%3Butm_medium=RSS"
},
{
"source": "report@snyk.io",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpujan2021.html"
},
{
"source": "report@snyk.io",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
}
],
"sourceIdentifier": "report@snyk.io",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1321"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.