automattic/mongoose · Security
Mongoose Prototype Pollution vulnerability
- GHSA ID
- GHSA-9m93-w8w6-76hh
- CVE ID
- CVE-2023-3696
- Severity
- critical
- Published
- Updated
- CVSS
- 10 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
- CVSS v3
- 10 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Description
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3696 ↗
- https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d ↗
- https://huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467 ↗
- https://github.com/Automattic/mongoose/commit/e29578d2ec18a68aeb4717d66dd5eb66bae53de1 ↗
- https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2 ↗
- https://github.com/Automattic/mongoose/releases/tag/7.3.3 ↗
- https://github.com/advisories/GHSA-9m93-w8w6-76hh ↗