{"id":"CVE-2020-15256","published":"2020-10-19T21:25:13Z","modified":"2024-08-04T13:08:23Z","title":"Prototype pollution in object-path","vendor":"mariocasciaro","product":"object-path","tier":"tail","description":{"text":"A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01546,"percentile":0.75007,"provenance":"source"},"cwes":[{"id":"CWE-471","name":"Modification of Assumed-Immutable Data (MAID)"},{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68","tags":["x_refsource_MISC"]}],"priority":{"score":20.4,"factors":[{"name":"EPSS percentile","points":15.0},{"name":"CVSS severity","points":5.39}]},"vendorSlug":"mariocasciaro","affectedVersions":[{"vendor":"mariocasciaro","product":"object-path","versions":["< 0.11.5"]}],"affected":[{"ecosystem":"npm","package":"object-path","vulnerableRanges":["<0.11.5"],"patched":["0.11.5"],"from":["GHSA-cwx2-736x-mf6w"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1425","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mariocasciaro-object-path-cve-2020-15256","children":[{"from":"CVE-2020-15256","to":"CVE-2021-23434","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays.","from":"CVE.org","in":"CVE-2021-23434"},{"kind":"version-step","provenance":"source","package":"npm:object-path","fromFixed":"0.11.5","toFixed":"0.11.6","daysApart":312}]}],"packageHistory":[{"cve":"CVE-2020-15256","published":"2020-10-19","fixed":"0.11.5","kev":false},{"cve":"CVE-2021-23434","published":"2021-08-27","fixed":"0.11.6","kev":false},{"cve":"CVE-2021-3805","published":"2021-09-17","fixed":"0.11.8","kev":false}],"package":"npm:object-path"}}