CVE-2020-7600 - querymen prior to 2.1.4 allows modification of object properties

Back Back to CVE browser

MEDIUM

querymen prior to 2.1.4 allows modification of object properties

Published Mar 12, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 1.16%

Description

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

Affected products

Vendor n/a Product Querymen Default
n/a
- Version
  All versions prior to 2.1.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Querymen

n/a

Version	Status	Constraints
All versions prior to 2.1.4	affected	-

Ecosystem	Package	Introduced	Fixed
npm	querymen	0	2.1.4

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1321

CWE-915

References (4)

https://github.com/advisories/GHSA-2cf2-2383-h4jv
Advisory
https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7600
https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-2cf2-2383-h4jv		Advisory
https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7600
https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867		x_refsource_MISCPatchThird Party Advisory