CVE-2020-15256 — Improper Input Validation in Project Object-path

CWE-20 — Improper Input ValidationCWE-471 — Modification of Assumed-Immutable DataCWE-843 — Type ConfusionCWE-915 — Improperly Controlled Modification of Dynamically-Determined Object AttributesCWE-1321 — Prototype Pollution14 documents6 sources
Severity
9.8CRITICALNVD
NVD8.6
EPSS
0.2%
top 62.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Object-path Project Object-pathDebian Node-object-pathDebian Linux
Timeline
PublishedOct 19
Latest updateMar 22

Description

A prototype pollution vulnerability has been found in `object-path` = 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions = 0.11.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/node-object-path< node-object-path 0.11.5-3 (bookworm)+1
▶CVEListV5object-path_project/object-pathunspecified — 0.11.6

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

7
OSV
node-object-path vulnerabilities↗2023-03-22
▶
OSV
Prototype Pollution in object-path↗2021-09-01
▶
GHSA
Prototype Pollution in object-path↗2021-09-01
▶
OSV
CVE-2021-23434: This affects the package object-path before 0↗2021-08-27
▶
OSV
Prototype pollution in object-path↗2020-10-19
▶

📋Vendor Advisories

5
Ubuntu
object-path vulnerabilities↗2023-03-22
▶
Red Hat
object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256↗2021-08-27
▶
Debian
CVE-2021-23434: node-object-path - This affects the package object-path before 0.11.6. A type confusion vulnerabili...↗2021
▶
Red Hat
object-path: Prototype pollution could result in DoS or RCE↗2020-10-20
▶
Debian
CVE-2020-15256: node-object-path - A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 af...↗2020
▶