CVE-2023-0163
published 2024-11-26CVE-2023-0163: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject…
PriorityP343high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.27%
19.4th percentile
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.
This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.
The main use case of Convict is for handling server-side
configurations written by the admins owning the servers, and not random
users. So it's unlikely that an admin would deliberately sabotage their
own server. Still, a situation can happen where an admin not
knowledgeable about JavaScript could be tricked by an attacker into
writing the malicious JavaScript code into some config files.
This issue affects Convict: before 6.2.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | convict | < 6.2.4 | 6.2.4 |
| mozilla | convict | >= 0 < 6.2.4 | 6.2.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
convict vulnerable to Prototype Pollution
ghsa·2023-01-10
CVE-2023-0163 [HIGH] CWE-1321 convict vulnerable to Prototype Pollution
convict vulnerable to Prototype Pollution
### Impact
* An attacker can inject attributes that are used in other components
* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.
### Patches
The problem is patched in `[email protected]`. Users should upgrade to `[email protected]`.
### Workarounds
No way for users to fix or remediate the vulnerability w
OSV
convict vulnerable to Prototype Pollution
osv·2023-01-10
CVE-2023-0163 [HIGH] convict vulnerable to Prototype Pollution
convict vulnerable to Prototype Pollution
### Impact
* An attacker can inject attributes that are used in other components
* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.
The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.
### Patches
The problem is patched in `[email protected]`. Users should upgrade to `[email protected]`.
### Workarounds
No way for users to fix or remediate the vulnerability w
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-26
Published