Information Exposure
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.8%
probabilidad de explotación
0.8%top 45% de las CVE
explotación observada
noninguna fuente lo reporta
The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
n/a · liquidjsReferencias
https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109dbhttps://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208https://github.com/harttle/liquidjs/issues/454https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJhttps://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868