CVE-2020-28480

Prototype Pollution

CVSS 7.3 HIGHEPSS 1.4%

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Produtos afetados

n/a · jointjs

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/clientIO/joint/blob/master/src/util/util.mjs%23L150 https://github.com/clientIO/joint/pull/1406 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1062037 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1062036 https://snyk.io/vuln/SNYK-JS-JOINTJS-1024444