digitalbazaar/forge · Security
Prototype Pollution in node-forge
- GHSA ID
- GHSA-92xj-mqp7-vmcj
- CVE ID
- CVE-2020-7720
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Description
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.
CWEs
- CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7720 ↗
- https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md ↗
- https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293 ↗
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677 ↗
- https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756 ↗
- https://github.com/advisories/GHSA-92xj-mqp7-vmcj ↗