mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-19 17:31:42 +00:00
358 lines
13 KiB
JSON
358 lines
13 KiB
JSON
{
|
|
"id": "CVE-2020-5258",
|
|
"sourceIdentifier": "security-advisories@github.com",
|
|
"published": "2020-03-10T18:15:12.123",
|
|
"lastModified": "2023-11-07T03:23:44.137",
|
|
"vulnStatus": "Modified",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2"
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En las versiones afectadas de dojo (paquete NPM), el m\u00e9todo deepCopy es vulnerable a una Contaminaci\u00f3n de Prototipo. La Contaminaci\u00f3n de Prototipo se refiere a la capacidad de inyectar propiedades en prototipos de construcciones de lenguaje JavaScript existentes, tales como objetos. Un atacante manipula estos atributos para sobrescribir o contaminar un prototipo de objeto de la aplicaci\u00f3n JavaScript del objeto base mediante la inyecci\u00f3n de otros valores. Esto ha sido parcheado en las versiones 1.12.8, 1.13.7, 1.14.6, 1.15.3 y 1.16.2"
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.7,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 1.3,
|
|
"impactScore": 5.8
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "LOW",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "PARTIAL",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.0
|
|
},
|
|
"baseSeverity": "MEDIUM",
|
|
"exploitabilityScore": 10.0,
|
|
"impactScore": 2.9,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": false
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-94"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-1321"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionEndExcluding": "1.11.10",
|
|
"matchCriteriaId": "89DAC674-74C9-4386-AFD3-2176D0C7EFE8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionStartIncluding": "1.12.0",
|
|
"versionEndExcluding": "1.12.8",
|
|
"matchCriteriaId": "48F3E53A-48A6-43A9-B7D5-2EFD771171E1"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionStartIncluding": "1.13.0",
|
|
"versionEndExcluding": "1.13.7",
|
|
"matchCriteriaId": "21446BEC-45A6-4517-B58D-E0597E5B76A6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionStartIncluding": "1.14.0",
|
|
"versionEndExcluding": "1.14.6",
|
|
"matchCriteriaId": "4C083E22-8F0E-47CB-9567-105B12BB8102"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionStartIncluding": "1.15.0",
|
|
"versionEndExcluding": "1.15.3",
|
|
"matchCriteriaId": "CD870D7B-AFF7-4A88-90C1-68828672557D"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*",
|
|
"versionStartIncluding": "1.16.0",
|
|
"versionEndExcluding": "1.16.2",
|
|
"matchCriteriaId": "84C08ACB-03A1-4DC5-A37A-DEC707BE905D"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "787E2C1B-9BAD-4018-8495-E9BE75628BB8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5312AC7A-3C16-4967-ACA6-317289A749D0"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D7B49D71-6A31-497A-B6A9-06E84F086E7A"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "12.6.0",
|
|
"versionEndIncluding": "12.6.4",
|
|
"matchCriteriaId": "135D531C-A692-4BE3-AB8C-37BB0D35559A"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.3.0",
|
|
"versionEndIncluding": "7.3.29",
|
|
"matchCriteriaId": "5FA170A0-A410-418D-90E4-F6A3FB4760A4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.4.0",
|
|
"versionEndIncluding": "7.4.28",
|
|
"matchCriteriaId": "CD3477A7-2F1F-40A3-893A-9E4B20937CBD"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.5.0",
|
|
"versionEndIncluding": "7.5.18",
|
|
"matchCriteriaId": "9FD21E94-2C49-4DA4-A081-6B1724CFA550"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.6.0",
|
|
"versionEndIncluding": "7.6.14",
|
|
"matchCriteriaId": "1D7A5C03-D134-4FCB-8512-78AEF249C077"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "8.0.0",
|
|
"versionEndIncluding": "8.0.20",
|
|
"matchCriteriaId": "0E1A3769-E443-4511-B349-B5304F5E6EBD"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "17.7",
|
|
"versionEndIncluding": "17.12",
|
|
"matchCriteriaId": "08FA59A8-6A62-4B33-8952-D6E658F8DAC9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "202AD518-2E9B-4062-B063-9858AE1F9CE2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "10864586-270E-4ACF-BDCC-ECFCD299305F"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "38340E3C-C452-4370-86D4-355B6B4E0A06"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D551CAB1-4312-44AA-BDA8-A030817E153A"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "174A6D2E-E42E-4C92-A194-C6A820CD7EF4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "04BCDC24-4A21-473C-8733-0D9CFB38A752"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Exploit",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3Cusers.qpid.apache.org%3E",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3%40%3Cusers.qpid.apache.org%3E",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00%40%3Cusers.qpid.apache.org%3E",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Mailing List",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com//security-alerts/cpujul2021.html",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpujan2022.html",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpujul2020.html",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Third Party Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpujul2022.html",
|
|
"source": "security-advisories@github.com"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html",
|
|
"source": "security-advisories@github.com",
|
|
"tags": [
|
|
"Patch",
|
|
"Third Party Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |