Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2020-8116 |
CWE-ID | CWE-400 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software Subscribe |
dot-prop Web applications / Modules and components for CMS |
Vendor | Sindre Sorhus |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU24833
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2020-8116
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to prototype pollution. A remote authenticated attacker can modify the prototype of a base object which can vary in severity depending on the implementation (DoS, access to sensitive data, RCE).
Install updates from vendor's website.
Vulnerable software versionsdot-prop: 1.0.0 - 5.1.0
External linkshttp://snyk.io/vuln/SNYK-JS-DOTPROP-543489
http://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2
http://hackerone.com/reports/719856
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.