GitHub Advisoryadvisory · npm
GHSA-vpgw-ffh3-648h Prototype Pollution in fullpage.js
HIGH
Official page ↗
- Aliases
- CVE-2022-1295
- Ecosystem
- npm
- Packages
- fullpage.js
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-1321
- Reviewed
- 2022-04-22
Affected packages
• npm fullpage.js: < 4.0.2 → fixed in 4.0.2
Description
fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.
Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.
Related
Alias · CVE (1)
- CVE-2022-1295 Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2. vulnerability
Weakness · CWE (1)
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness