CVE-2020-5258

Home/CVE/In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollutio

CVE

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollutio

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.

This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2.

HIGH · CVSS 7.7 EPSS 0.0154

Act now

Public exploit or PoC is available
CVSS base score ≥ 7.0

Sigma rules2 YARA rules0

⬡

Weakness Classification

CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-94Improper Control of Generation of Code ('Code Injection')

▤

Affected Products & Versions

linuxfoundation dojo< 1.11.10
linuxfoundation dojo>= 1.12.0 and < 1.12.8
linuxfoundation dojo>= 1.13.0 and < 1.13.7
linuxfoundation dojo>= 1.14.0 and < 1.14.6
linuxfoundation dojo>= 1.15.0 and < 1.15.3
linuxfoundation dojo>= 1.16.0 and < 1.16.2
debian linuxall versions
oracle communications application session controllerall versions
Show all 20 affected productsoracle communications policy managementall versions
oracle communications pricing design centerall versions
oracle documaker>= 12.6.0 and <= 12.6.4
oracle mysql>= 7.3.0 and <= 7.3.29
oracle mysql>= 7.4.0 and <= 7.4.28
oracle mysql>= 7.5.0 and <= 7.5.18
oracle mysql>= 7.6.0 and <= 7.6.14
oracle mysql>= 8.0.0 and <= 8.0.20
oracle primavera unifier>= 17.7 and <= 17.12
oracle primavera unifierall versions
oracle webcenter sitesall versions
oracle weblogic serverall versions

▤

Affected Packages

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

npm dojo HIGH fixed in 1.11.10

⚠

Public Exploits & PoCs

pocgithub.com · GHSA-jxfh-8wgv-vfr2github.com

◈

Sigma Hunt Rules

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighOpenCanary - MySQL Login Attempt

producthighUncommon File Creation By Mysql Daemon Process

▣