CVE-2019-10744

Home/CVE/Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked

CVE

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CRITICAL · CVSS 9.1 EPSS 0.14845

Act now

EPSS ≥ 0.10 - elevated exploitation probability
EPSS percentile: top 5% of all CVEs by exploitation likelihood
Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules0 YARA rules0

⬡

Weakness Classification

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

▤

Affected Products & Versions

lodash< 4.17.12
netapp active iq unified managerall versions
netapp service level managerall versions
redhat virtualization managerall versions
oracle banking extensibility workbenchall versions
f5 big-ip access policy manager>= 12.1.0 and < 12.1.5.2
f5 big-ip access policy manager>= 13.1.0 and < 13.1.3.4
f5 big-ip access policy manager>= 14.1.0 and < 14.1.2.5
Show all 57 affected productsf5 big-ip access policy manager>= 15.0.0 and < 15.0.1.4
f5 big-ip access policy manager>= 15.1.0 and < 15.1.0.2
f5 big-ip advanced firewall manager>= 12.1.0 and < 12.1.5.2
f5 big-ip advanced firewall manager>= 13.1.0 and < 13.1.3.4
f5 big-ip advanced firewall manager>= 14.1.0 and < 14.1.2.5
f5 big-ip advanced firewall manager>= 15.0.0 and < 15.0.1.4
f5 big-ip advanced firewall manager>= 15.1.0 and < 15.1.0.2
f5 big-ip analytics>= 12.1.0 and <= 12.1.5
f5 big-ip analytics>= 13.1.0 and <= 13.1.3
f5 big-ip analytics>= 14.1.0 and <= 14.1.2
f5 big-ip analytics>= 15.0.0 and < 15.0.1.3
f5 big-ip analytics>= 15.1.0 and < 15.1.0.2
f5 big-ip application acceleration manager>= 12.1.0 and < 12.1.5.2
f5 big-ip application acceleration manager>= 13.1.0 and < 13.1.3.4
f5 big-ip application acceleration manager>= 14.1.0 and < 14.1.2.5
f5 big-ip application acceleration manager>= 15.0.0 and < 15.0.1.4
f5 big-ip application acceleration manager>= 15.1.0 and < 15.1.0.2
f5 big-ip application security manager>= 12.1.0 and < 12.1.5.2
f5 big-ip application security manager>= 13.1.0 and < 13.1.3.4
f5 big-ip application security manager>= 14.1.0 and < 14.1.2.5
f5 big-ip application security manager>= 15.0.0 and < 15.0.1.4
f5 big-ip application security manager>= 15.1.0 and < 15.1.0.2
f5 big-ip application visibility and reporting>= 12.1.0 and < 12.1.5.2
f5 big-ip application visibility and reporting>= 13.1.0 and <= 13.1.3
f5 big-ip application visibility and reporting>= 14.1.0 and < 14.1.2.5
f5 big-ip application visibility and reporting>= 15.1.0 and < 15.1.1
f5 big-ip domain name system>= 12.1.0 and < 12.1.5.2
f5 big-ip domain name system>= 13.1.0 and < 13.1.3.4
f5 big-ip domain name system>= 14.1.0 and < 14.1.2.5
f5 big-ip domain name system>= 15.0.0 and < 15.0.1.4
f5 big-ip domain name system>= 15.1.0 and < 15.1.0.2
f5 big-ip edge gateway>= 12.1.0 and < 12.1.5.2
f5 big-ip edge gateway>= 13.1.0 and < 13.1.3.4
f5 big-ip edge gateway>= 14.1.0 and < 14.1.2.5
f5 big-ip edge gateway>= 15.0.0 and < 15.0.1.4
f5 big-ip edge gateway>= 15.1.0 and < 15.1.0.2
f5 big-ip fraud protection service>= 12.1.0 and < 12.1.5.2
f5 big-ip fraud protection service>= 13.1.0 and < 13.1.3.4
f5 big-ip fraud protection service>= 14.1.0 and < 14.1.2.5
f5 big-ip fraud protection service>= 15.0.0 and < 15.0.1.4
f5 big-ip fraud protection service>= 15.1.0 and < 15.1.0.2
f5 big-ip global traffic manager>= 12.1.0 and < 12.1.5.2
f5 big-ip global traffic manager>= 13.1.0 and < 13.1.3.4
f5 big-ip global traffic manager>= 14.1.0 and < 14.1.2.5
f5 big-ip global traffic manager>= 15.0.0 and < 15.0.1.4
f5 big-ip global traffic manager>= 15.1.0 and < 15.1.0.2
f5 big-ip link controller>= 12.1.0 and < 12.1.5.2
f5 big-ip link controller>= 13.1.0 and < 13.1.3.4
f5 big-ip link controller>= 14.1.0 and < 14.1.2.5

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

RubyGems lodash-rails CRITICAL fixed in 4.17.12

npm lodash CRITICAL fixed in 4.17.12

npm lodash-amd CRITICAL fixed in 4.17.13

npm lodash-es CRITICAL fixed in 4.17.14

npm lodash.defaultsdeep CRITICAL fixed in 4.6.1

⚠

Public Exploits & PoCs

pocsnyk.io · SNYK-JS-LODASH-450202snyk.io

▣

Scoring & Timeline

9.1

CRITICAL · CVSS v3.1 · report@snyk.io

View on NVD

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

Published to NVD26 Jul 2019 · 12:15 AM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

⚑

Vendor Advisories

rhsaRHSA-2022:5101Important
rhsaRHSA-2021:5134Critical
rhsaRHSA-2021:0549Moderate
rhsaRHSA-2021:0485Moderate
rhsaRHSA-2020:2362Moderate
Show all 7 vendor advisoriesrhsaRHSA-2020:2819Important
rhsaRHSA-2019:3024Important

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

https://security.netapp.com/advisory/ntap-20191004-0005/Third Party Advisory

https://support.f5.com/csp/article/K47105354?utm_source=f5support&ampThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.htmlPatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.htmlPatchThird Party Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin