gsd-2019-10744
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Aliases
Aliases
{ GSD: { alias: "CVE-2019-10744", description: "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", id: "GSD-2019-10744", references: [ "https://www.suse.com/security/cve/CVE-2019-10744.html", "https://access.redhat.com/errata/RHSA-2021:5134", "https://access.redhat.com/errata/RHSA-2020:2819", "https://access.redhat.com/errata/RHSA-2020:2362", "https://access.redhat.com/errata/RHSA-2019:3024", "https://access.redhat.com/errata/RHSA-2022:5101", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2019-10744", ], details: "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", id: "GSD-2019-10744", modified: "2023-12-13T01:23:57.424291Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "report@snyk.io", ID: "CVE-2019-10744", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "lodash", version: { version_data: [ { version_value: "All versions prior to 4.17.12", }, ], }, }, ], }, vendor_name: "Snyk", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "Prototype Pollution", }, ], }, ], }, references: { reference_data: [ { name: "RHSA-2019:3024", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:3024", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://snyk.io/vuln/SNYK-JS-LODASH-450202", refsource: "CONFIRM", url: "https://snyk.io/vuln/SNYK-JS-LODASH-450202", }, { name: "https://security.netapp.com/advisory/ntap-20191004-0005/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20191004-0005/", }, { name: "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", }, { name: "https://www.oracle.com/security-alerts/cpujan2021.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, ], }, }, "gitlab.com": { advisories: [ { affected_range: "<4.17.13", affected_versions: "All versions before 4.17.13", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.17.13", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.17.13", package_slug: "npm/lodash-amd", pubdate: "2019-07-10", solution: "Upgrade to version 4.17.13 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "d9547eba-658d-4462-9224-16ecb70f9fca", }, { affected_range: "<4.17.14", affected_versions: "All versions before 4.17.14", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.17.14", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.17.14", package_slug: "npm/lodash-es", pubdate: "2019-07-10", solution: "Upgrade to version 4.17.14 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "c3616d0c-e7d3-427d-87ef-3f64cd0eea48", }, { affected_range: "<4.6.1", affected_versions: "All versions before 4.6.1", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.6.1", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.6.1", package_slug: "npm/lodash.defaultsdeep", pubdate: "2019-07-10", solution: "Upgrade to version 4.6.1 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "b44b8ff7-9f98-4799-b079-7ddebcc80fb5", }, { affected_range: "<4.6.2", affected_versions: "All versions before 4.6.2", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.6.2", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.6.2", package_slug: "npm/lodash.merge", pubdate: "2019-07-10", solution: "Upgrade to version 4.6.2 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "61a1c16c-47f4-4b19-9e1b-74bf2ed3aef2", }, { affected_range: "<4.6.2", affected_versions: "All versions before 4.6.2", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.6.2", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.6.2", package_slug: "npm/lodash.mergewith", pubdate: "2019-07-10", solution: "Upgrade to version 4.6.2 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "14a5a248-8e25-472d-97ea-9137acf5dfad", }, { affected_range: "<4.5.0", affected_versions: "All versions before 4.5.0", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:P/A:P", cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2021-08-17", description: "Versions of lodash lower than are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", fixed_versions: [ "4.5.0", ], identifier: "CVE-2019-10744", identifiers: [ "GHSA-jf85-cpcp-j695", "CVE-2019-10744", ], not_impacted: "All versions starting from 4.5.0", package_slug: "npm/lodash.template", pubdate: "2019-07-10", solution: "Upgrade to version 4.5.0 or above.", title: "Prototype Pollution in lodash", urls: [ "https://github.com/lodash/lodash/pull/4336", "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "https://snyk.io/vuln/SNYK-JS-LODASH-450202", "https://www.npmjs.com/advisories/1065", "https://access.redhat.com/errata/RHSA-2019:3024", "https://security.netapp.com/advisory/ntap-20191004-0005/", "https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://www.oracle.com/security-alerts/cpuoct2020.html", "https://github.com/advisories/GHSA-jf85-cpcp-j695", ], uuid: "ee4ac735-0da2-4b6c-9bde-dc480cbbe713", }, { affected_range: "<4.17.12", affected_versions: "All versions before 4.17.12", cvss_v2: "AV:N/AC:L/Au:N/C:P/I:P/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-937", ], date: "2019-10-04", description: "lodash is vulnerable to Prototype Pollution. The function `defaultsDeep` could be tricked into adding or modifying properties of `Object.prototype` using a constructor payload.", fixed_versions: [ "4.17.12", ], identifier: "CVE-2019-10744", identifiers: [ "CVE-2019-10744", ], not_impacted: "All versions starting from 4.17.12", package_slug: "npm/lodash", pubdate: "2019-07-25", solution: "Upgrade to version 4.17.12 or above.", title: "Improper Input Validation", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", ], uuid: "4774cd67-936f-419e-8533-ae5cfe7db9f9", }, ], }, "nvd.nist.gov": { cve: { configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*", matchCriteriaId: "5C21E48F-F34A-4124-9EF1-C106EB3B2209", versionEndExcluding: "4.17.12", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*", matchCriteriaId: "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1", vulnerable: true, }, { criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*", matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5", vulnerable: true, }, { criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*", matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE", vulnerable: true, }, { criteria: "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*", matchCriteriaId: "7081652A-D28B-494E-94EF-CA88117F23EE", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*", matchCriteriaId: "9FA1A18F-D997-4121-A01B-FD9B3BF266CF", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*", matchCriteriaId: "EABAFD73-150F-4DFE-B721-29EB4475D979", vulnerable: true, }, { criteria: "cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*", matchCriteriaId: "DE57039D-E2EE-4014-A7B1-D7380D26098E", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "EE0532FA-7B7B-46B3-AB10-0920034A7E43", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "592327AA-BCC4-4CD0-82C6-EA739F049E82", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "2980BE62-6B8C-4E2A-B4EF-38A23E1CCD21", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "E9170095-A9BB-4D24-9925-39256D7CE2C6", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "56414352-0A79-4ED2-B670-D7CC9508FA9D", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "3B3DCE49-C37D-4951-AB57-7CDDEBA1C1E5", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "3DD78D19-D17E-45EC-98C7-74D086AE68AA", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "322E6570-185C-4413-A7CE-674CBAE95D05", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "5B59E16D-7645-492A-9C1D-A8724FFCA28F", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "0BA6818C-DCCE-4347-935A-CE6BA0014CDE", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", matchCriteriaId: "5D5AA99B-08E7-4959-A3B4-41AA527B4B22", versionEndIncluding: "12.1.5", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", matchCriteriaId: "4AC8FD5C-AE1A-4484-BB6F-EBB6A48D21F8", versionEndIncluding: "13.1.3", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", matchCriteriaId: "EC15881B-9C49-4E77-9FB6-A6E60D0BCAD3", versionEndIncluding: "14.1.2", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", matchCriteriaId: "D29F60E2-E39D-46E8-935E-8E0A0D32E262", versionEndExcluding: "15.0.1.3", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", matchCriteriaId: "F302F7BC-A08A-4DB3-A257-699C7DBDCAB0", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "5D3F7911-FB00-4612-9109-9E7A407BC7B7", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "B547F46F-5563-4E7F-8B69-3D25C6C58521", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "78753BD2-6631-459D-AD89-0FE2C0F3FDD5", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "997D12F1-098D-4C42-A6A2-B4F59AC78F0F", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "45920B7E-10A6-4066-87AB-60D584689891", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "91BF72A9-EB50-4315-B956-5926967DCC46", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "4AEE0B76-3F8E-420A-9589-BF3FDB942DEB", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "DA9E370F-2A37-4612-91DD-2B1FD7EECCE7", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "E6C4B56F-D022-4268-9D78-6E4D12AE9215", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "53CA3EC2-CE36-4388-A7A9-4311AD80A8B2", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", matchCriteriaId: "5043F299-FEE6-4878-8616-D2976FAC2BDF", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", matchCriteriaId: "E59859F8-3BF6-4BE3-8E4B-DF3B68303B22", versionEndIncluding: "13.1.3", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", matchCriteriaId: "024C7911-8C97-4A94-8F0B-18BE2109A499", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*", matchCriteriaId: "9E14CCF2-E795-4763-A560-2C54C55619BE", versionEndExcluding: "15.1.1", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", matchCriteriaId: "73EC8EDA-669A-4750-934F-3B3FBF557080", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", matchCriteriaId: "C7917031-0735-483C-A8DA-11430056D568", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", matchCriteriaId: "5E10BF5A-2BD0-4791-B842-358968AFC9E6", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", matchCriteriaId: "EAFC0D83-7F64-44F2-A014-37DE3CAF846A", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", matchCriteriaId: "6419B4B3-DE7A-4B72-BFFC-6C646AC07BB7", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", matchCriteriaId: "5C3C6E77-BB41-48AA-AFEA-8C6F18BE7025", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", matchCriteriaId: "156F3B54-1827-4048-AACD-835092853943", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", matchCriteriaId: "206B46BD-846A-493C-BC83-531E6CD45F5A", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", matchCriteriaId: "DC1CC599-DA9C-46BD-9C5C-FD25D57AE9D6", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*", matchCriteriaId: "C00CAEFA-C255-4C0B-8DE1-12686EC7D09B", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", matchCriteriaId: "A0581EEF-98E6-4961-8178-BA2D7647F931", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", matchCriteriaId: "FFC5C221-AE58-4580-876A-E5FD7970A695", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", matchCriteriaId: "27A9FAF9-7198-41FD-B093-AE11DD5AD67B", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", matchCriteriaId: "920BC3DD-A1D4-403B-83D2-00636C20FFC0", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", matchCriteriaId: "2BDD592C-6DBC-4A35-8483-ACC471FF92E3", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "32773569-67FE-4F08-A613-E507FCDEACEF", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "463AA399-492A-4DB6-BFD1-31725012AE8F", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "94F1100B-0EE4-41A7-AD34-336D4335751D", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "49C8BE4A-DED6-451A-B6EE-AC95DD26F85A", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "B3087972-862F-4A0D-9D9D-38BAB9D383F4", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", matchCriteriaId: "4494F771-4026-478C-8004-B162653DC80C", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", matchCriteriaId: "98314370-E3C8-4CB5-9F48-57004EB96D8F", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", matchCriteriaId: "929E75AD-5DC4-4992-A589-BA4516BC38FA", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", matchCriteriaId: "DEC0E30F-6550-4BC9-8DA7-6BD495DBF415", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", matchCriteriaId: "45641A58-0B5B-48C6-B0A3-0822A86A00AC", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "A97489DC-A5DE-48AD-BBA2-F9078070F53A", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "FBF128B7-874B-4E3A-B52F-1C2DE34F64A9", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "50AB72FA-552D-4B37-9C58-B4AB3B7B989A", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "D5D90F4A-FA2A-412F-8591-D1CA6399ECAD", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "8B5F9367-89D5-4D7D-A0FE-6C289E0A606C", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "1EDB944B-DF60-45AF-AD60-33E9667E0D12", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "20C58940-C7A3-47A9-8C9E-7B652E4F4750", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "DA5A4B1B-F4F0-4053-8756-2C84AA885060", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "BAD2867D-D646-4B01-A383-6A47B51D059E", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", matchCriteriaId: "D7C50229-3A95-4AA8-A720-4D35FF482DC3", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", matchCriteriaId: "02CB8916-A9ED-4935-BFBD-5C9E8D45379E", versionEndExcluding: "12.1.5.2", versionStartIncluding: "12.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", matchCriteriaId: "5853A161-2F92-4298-A70A-03A66DED157C", versionEndExcluding: "13.1.3.4", versionStartIncluding: "13.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", matchCriteriaId: "A86EF843-B0CB-4FB0-9E0A-51F7DD3BD44B", versionEndExcluding: "14.1.2.5", versionStartIncluding: "14.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", matchCriteriaId: "126DC4FA-E5EB-43E1-83F9-19F29E852E03", versionEndExcluding: "15.0.1.4", versionStartIncluding: "15.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*", matchCriteriaId: "0064DE79-D6D6-4AE0-BF10-BF91FF9158DF", versionEndExcluding: "15.1.0.2", versionStartIncluding: "15.1.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*", matchCriteriaId: "F37D18F2-8C6A-4557-85DC-2A751595423C", versionEndIncluding: "6.1.0", versionStartIncluding: "6.0.0", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:*", matchCriteriaId: "A5C1DACF-0562-4A41-A9EC-60D1DC065007", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:*", matchCriteriaId: "2B589C35-55F2-4D40-B5A6-8267EE20D627", vulnerable: true, }, { criteria: "cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:*", matchCriteriaId: "D3CE7526-9630-48EF-81FB-44904AF0653F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], descriptions: [ { lang: "en", value: "Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.", }, { lang: "es", value: "Las versiones de lodash inferiores a 4.17.12, son vulnerables a la ContaminaciĂłn de Prototipo. La funciĂłn defaultsDeep podrĂa ser engañada para agregar o modificar las propiedades de Object.prototype usando una carga Ăştil de constructor.", }, ], id: "CVE-2019-10744", lastModified: "2024-01-21T02:45:24.433", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 6.4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 4.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.1, baseSeverity: "CRITICAL", confidentialityImpact: "NONE", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.2, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-07-26T00:15:11.217", references: [ { source: "report@snyk.io", tags: [ "Third Party Advisory", ], url: "https://access.redhat.com/errata/RHSA-2019:3024", }, { source: "report@snyk.io", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20191004-0005/", }, { source: "report@snyk.io", tags: [ "Exploit", "Third Party Advisory", ], url: "https://snyk.io/vuln/SNYK-JS-LODASH-450202", }, { source: "report@snyk.io", tags: [ "Third Party Advisory", ], url: "https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS", }, { source: "report@snyk.io", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { source: "report@snyk.io", tags: [ "Patch", "Third Party Advisory", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, ], sourceIdentifier: "report@snyk.io", vulnStatus: "Analyzed", weaknesses: [ { description: [ { lang: "en", value: "CWE-1321", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }, }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.