CVE-2020-15366 — Prototype Pollution in Node-ajv

CWE-1321 — Prototype PollutionCWE-471 — Modification of Assumed-Immutable DataCWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes7 documents6 sources
Severity
5.6MEDIUMNVD
EPSS
0.4%
top 42.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Node-ajvAjv.js AJV
Timeline
PublishedJul 15
Latest updateFeb 10

Description

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 2.2 | Impact: 3.4

Affected Packages3 packages

▶npmajv.js/ajv< 6.12.3
▶debiandebian/node-ajv< node-ajv 6.12.4-1 (bookworm)
▶NVDajv.js/ajv6.12.2

🔴Vulnerability Details

3
OSV
Prototype Pollution in Ajv↗2022-02-10
▶
GHSA
Prototype Pollution in Ajv↗2022-02-10
▶
OSV
CVE-2020-15366: An issue was discovered in ajv↗2020-07-15
▶

📋Vendor Advisories

2
Red Hat
nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function↗2020-07-04
▶
Debian
CVE-2020-15366: node-ajv - An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Valida...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function↗2020-07-16
▶
CVE-2020-15366 — Prototype Pollution in Debian Node-ajv | cvebase