cve/2020/CVE-2020-7720.md

CVE-2020-7720

Description

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293
• https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
• https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677

Github

• https://github.com/404notf0und/CVE-Flow
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Live-Hack-CVE/CVE-2020-7720
• https://github.com/flv12/url-shortener
• https://github.com/flvoyer/url-shortener
• https://github.com/ossf-cve-benchmark/CVE-2020-7720