CVE-2020-28273
published 2020-12-02CVE-2020-28273: Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.88%
89.1th percentile
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| set-in_project | set-in | < 2.0.3 | 2.0.3 |
| set-in_project | set-in | >= 0 < 2.0.1 | 2.0.1 |
| set-in_project | set-in | >= 0 < 2.0.3 | 2.0.3 |
| set-in_project | set-in | 1.0.0 – 2.0.0 | — |
| set-in_project | set-in | >= unspecified < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Prototype Pollution in set-in
osv·2022-03-18·CVSS 9.8
CVE-2022-25354 [CRITICAL] Prototype Pollution in set-in
Prototype Pollution in set-in
The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
GHSA
Prototype Pollution in set-in
ghsa·2022-03-18·CVSS 9.8
CVE-2022-25354 [CRITICAL] CWE-1321 Prototype Pollution in set-in
Prototype Pollution in set-in
The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
OSV
Prototype pollution in set-in
osv·2021-03-19
CVE-2020-28273 [CRITICAL] Prototype pollution in set-in
Prototype pollution in set-in
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
GHSA
Prototype pollution in set-in
ghsa·2021-03-19
CVE-2020-28273 [CRITICAL] CWE-1321 Prototype pollution in set-in
Prototype pollution in set-in
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88https://www.whitesourcesoftware.com/vulnerability-databasehttps://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273https://github.com/ahdinosaur/set-in/commit/e431effa00195a6f06b111e09733cd1445a91a88https://www.whitesourcesoftware.com/vulnerability-databasehttps://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28273
2020-12-02
Published