CVE-2020-8203
ADVISORY - githubSummary
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.
This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
Common Weakness Enumeration (CWE)
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Allocation of Resources Without Limits or Throttling
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
Improper Input Validation
NIST
CVSS SCORE
7.4highGitHub
CVSS SCORE
7.4highDebian
-
Ubuntu
2.2
CVSS SCORE
7.4mediumRed Hat
2.2
CVSS SCORE
7.4mediumintheWild
-
-