CVE-2020-5258
High
Description
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
SeverityHigh
CVSS7.7
Exploit probability—
Product
Linuxfoundation Dojo
PublishedMar 10, 2020
First seenMar 10, 2020
Weakness typeCWE-94Code injection
How to fix
Update
- linuxfoundation dojo1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2 or later
- dojo1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation dojo | v < 1.11.10, 1.12.0 ≤ v < 1.12.8, 1.13.0 ≤ v < 1.13.7, 1.14.0 ≤ v < 1.14.6, 1.15.0 ≤ v < 1.15.3, 1.16.0 ≤ v < 1.16.2 | 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2 |
| debian debian_linux | 8.0 | — |
| oracle communications_application_session_controller | 3.9.0 | — |
| oracle communications_policy_management | 12.5.0 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0 | — |
| oracle documaker | 12.6.0 ≤ v ≤ 12.6.4 | — |
| oracle mysql | 7.3.0 ≤ v ≤ 7.3.29, 7.4.0 ≤ v ≤ 7.4.28, 7.5.0 ≤ v ≤ 7.5.18, 7.6.0 ≤ v ≤ 7.6.14, 8.0.0 ≤ v ≤ 8.0.20 | — |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 18.8, 19.12, 20.12 | — |
| oracle webcenter_sites | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle weblogic_server | 12.2.1.4.0, 14.1.1.0.0 | — |
| dojonpm | v < 1.11.10, 1.12.0 ≤ v < 1.12.8, 1.13.0 ≤ v < 1.13.7, 1.14.0 ≤ v < 1.14.6, 1.15.0 ≤ v < 1.15.3, 1.16.0 ≤ v < 1.16.2 | 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, 1.16.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.