CVE-2019-10744
ADVISORY - githubSummary
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.12 or later.
EPSS Score: 0.0341 (0.869)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
ADVISORY - github
ADVISORY - gitlab
ADVISORY - redhat
Improper Input Validation
NIST
CREATED
UPDATED
ADVISORY IDCVE-2019-10744
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
9.1criticalGitHub
CVSS SCORE
9.1criticalDebian
CREATED
UPDATED
ADVISORY IDCVE-2019-10744
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2019-10744
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
9.1mediumRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2019-10744
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
9.1highintheWild
CREATED
UPDATED
ADVISORY IDCVE-2019-10744
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-