Yüksek CVSS 7.7 PoC var

CVE-2020-5258: Dojo: kod enjeksiyonu

Yayın: 10 Mart 2020 21:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Özet bilgiler

Ürün: Linuxfoundation Dojo
CVSS v3.1: 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS: %4,02 (yüzdelik 91)
CWE: CWE-94
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linuxfoundation-dojo	—	—	1.11.10
linuxfoundation-dojo	1.12.0	—	1.12.8
linuxfoundation-dojo	1.13.0	—	1.13.7
linuxfoundation-dojo	1.14.0	—	1.14.6
linuxfoundation-dojo	1.15.0	—	1.15.3
linuxfoundation-dojo	1.16.0	—	1.16.2
debian-debian-linux	8.0	8.0	—
oracle-communications-application-session-controller	3.9.0	3.9.0	—
oracle-communications-policy-management	12.5.0	12.5.0	—
oracle-communications-pricing-design-center	12.0.0.3.0	12.0.0.3.0	—
oracle-documaker	12.6.0	12.6.4	—
oracle-mysql	7.3.0	7.3.29	—
oracle-mysql	7.4.0	7.4.28	—
oracle-mysql	7.5.0	7.5.18	—
oracle-mysql	7.6.0	7.6.14	—
oracle-mysql	8.0.0	8.0.20	—
oracle-primavera-unifier	17.7	17.12	—
oracle-primavera-unifier	18.8	18.8	—
oracle-primavera-unifier	19.12	19.12	—
oracle-primavera-unifier	20.12	20.12	—
oracle-webcenter-sites	12.2.1.3.0	12.2.1.3.0	—
oracle-webcenter-sites	12.2.1.4.0	12.2.1.4.0	—
oracle-weblogic-server	12.2.1.4.0	12.2.1.4.0	—
oracle-weblogic-server	14.1.1.0.0	14.1.1.0.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları