GitHub Advisoryadvisory · npm

GHSA-jxfh-8wgv-vfr2 Prototype pollution in dojo

HIGH Published 2020-03-10 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-5258
Ecosystem
npm
Packages
dojo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-1321, CWE-74, CWE-94
Reviewed
2020-03-10

Affected packages

• npm dojo: < 1.11.10 → fixed in 1.11.10 • npm dojo: >= 1.12.0, < 1.12.8 → fixed in 1.12.8 • npm dojo: >= 1.13.0, < 1.13.7 → fixed in 1.13.7 • npm dojo: >= 1.14.0, < 1.14.6 → fixed in 1.14.6 • npm dojo: >= 1.15.0, < 1.15.3 → fixed in 1.15.3 • npm dojo: >= 1.16.0, < 1.16.2 → fixed in 1.16.2

Description

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Related

Alias · CVE (1)

  • CVE-2020-5258 In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. vulnerability

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References