Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2019:3024 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20191004-0005/ | Third Party Advisory |
https://snyk.io/vuln/SNYK-JS-LODASH-450202 | Exploit Third Party Advisory |
https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS | Third Party Advisory |
https://www.oracle.com/security-alerts/cpujan2021.html | Patch Third Party Advisory |
https://www.oracle.com/security-alerts/cpuoct2020.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Jan 2024, 02:45
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-1321 | |
CPE | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* |
|
References |
|
|
References | (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Patch, Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - Patch, Third Party Advisory |
Information
Published : 2019-07-26 00:15
Updated : 2024-02-04 20:20
NVD link : CVE-2019-10744
Mitre link : CVE-2019-10744
CVE.ORG link : CVE-2019-10744
JSON object : View
Products Affected
f5
- big-ip_webaccelerator
- big-ip_analytics
- big-ip_link_controller
- big-ip_edge_gateway
- big-ip_policy_enforcement_manager
- big-ip_fraud_protection_service
- big-ip_application_security_manager
- iworkflow
- big-ip_application_visibility_and_reporting
- big-ip_access_policy_manager
- big-iq_centralized_management
- big-ip_global_traffic_manager
- big-ip_domain_name_system
- big-ip_application_acceleration_manager
- big-ip_advanced_firewall_manager
- big-ip_local_traffic_manager
lodash
- lodash
redhat
- virtualization_manager
netapp
- service_level_manager
- active_iq_unified_manager
oracle
- banking_extensibility_workbench
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')