GitHub Advisoryadvisory · npm

GHSA-p33m-7w7f-gmj8 Uncontrolled Resource Consumption in fun-map

HIGH Published 2021-12-10 Modified 2021-07-29 Official page ↗
Aliases
CVE-2020-7644
Ecosystem
npm
Packages
fun-map
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-05-25

Affected packages

• npm fun-map: <= 3.3.1 (no fix yet)

Description

fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

Related

Alias · CVE (1)

  • CVE-2020-7644 fun-map through 3.3.1 is vulnerable to Prototype Pollution. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References