CVE-2019-10744 (Critical) detected in lodash-4.17.4.tgz
Opened this issue · 0 comments
CVE-2019-10744 - Critical Severity Vulnerability
Vulnerable Library - lodash-4.17.4.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz
Path to dependency file: /exec-ui/package.json
Path to vulnerable library: /exec-ui/node_modules/lodash/package.json
Dependency Hierarchy:
- ngx-infinite-scroll-0.8.4.tgz (Root Library)
- opencollective-1.0.3.tgz
- inquirer-3.0.6.tgz
- ❌ lodash-4.17.4.tgz (Vulnerable Library)
- inquirer-3.0.6.tgz
- opencollective-1.0.3.tgz
Found in HEAD commit: 7b16df0bfd847c502ac80c1464fe08140edf5d0d
Found in base branch: master
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (ngx-infinite-scroll): 0.9.0
Step up your Open Source Security Game with Mend here