GitHub Advisoryadvisory · npm

GHSA-3x3f-jcp3-g22j @backstage/plugin-catalog-backend Prototype Pollution vulnerability

HIGH Published 2024-09-17 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-45815
Ecosystem
npm
Packages
@backstage/plugin-catalog-backend
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2024-09-17

Affected packages

• npm @backstage/plugin-catalog-backend: < 1.26.0 → fixed in 1.26.0

Description

Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Patches This has been fixed in the `1.26.0` release of the `@backstage/plugin-catalog-backend` package. References If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

Related

Alias · CVE (1)

  • CVE-2024-45815 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References