CVE-2020-7617 - Prototype Pollution

Back Back to CVE browser

CRITICAL

Prototype Pollution

Published Apr 2, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 0.86%

Description

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.

Affected products

Vendor Rawiroaisen Product Ini-Parser Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=0.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rawiroaisen

Ini-Parser

n/a

Version	Status	Constraints
unspecified	affected	<=0.0.2

Ecosystem	Package	Introduced	Fixed
npm	ini-parser	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1321

CWE-915

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0473
Advisory
https://github.com/advisories/GHSA-96r7-mrqf-jhcc
Advisory
https://github.com/rawiroaisen/node-ini-parser/blob/master/index.js#L14
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7617
https://snyk.io/vuln/SNYK-JS-INIPARSER-564122
x_refsource_MISCMitigationThird Party Advisory
https://www.npmjs.com/advisories/1508

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-0473		Advisory
https://github.com/advisories/GHSA-96r7-mrqf-jhcc		Advisory
https://github.com/rawiroaisen/node-ini-parser/blob/master/index.js#L14		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7617
https://snyk.io/vuln/SNYK-JS-INIPARSER-564122		x_refsource_MISCMitigationThird Party Advisory
https://www.npmjs.com/advisories/1508