CVE-2020-7766
High
Description
This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
SeverityHigh
CVSS7.3
Exploit probability—
ProductJson-ptr
PublishedNov 10, 2020
First seenNov 10, 2020
How to fix
Update
- json-ptr_project json-ptr2.0.0 or later
- json-ptr2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| json-ptr_project json-ptr | v < 2.0.0 | 2.0.0 |
| json-ptrnpm | v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.