GitHub Advisoryadvisory · npm

GHSA-2cf2-2383-h4jv Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen

MEDIUM Published 2021-05-07 Modified 2021-07-28 Official page ↗
Aliases
CVE-2020-7600
Ecosystem
npm
Packages
querymen
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-05-03

Affected packages

• npm querymen: < 2.1.4 → fixed in 2.1.4

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Related

Alias · CVE (1)

  • CVE-2020-7600 querymen prior to 2.1.4 allows modification of object properties. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References