Prototype pollution in Lodash - CVE-2018-16487

Vulnerability identifier: #VU19305

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-16487

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the merge, mergeWith, and defaultsDeep functions. A remote attacker can send a specially crafted request and add or modify properties of Object.prototype.

Successful exploitation of this vulnerability may result in complete compromise of the affected application.

Lodash
QRadar Pulse App
watsonx Orchestrate Developer Edition
IBM Watson Machine Learning Accelerator
watsonx.data integration
Rational Performance Tester
DevOps Test Performance
Business Automation Insights
MobileFirst Platform
IBM Intelligent Operations Center
IBM Tivoli Netcool/OMNIbus WebGUI
IBM SPSS Collaboration and Deployment Services
IBM Cloud Pak for Business Automation
IBM Cloud Transformation Advisor
IBM Process Mining
IBM Security Verify Governance
IBM Security SOAR

Install updates from vendor's website.

Lodash - update to 4.17.11
QRadar Pulse App - update to 2.2.9
watsonx Orchestrate Developer Edition - update to 2.0.0
IBM Watson Machine Learning Accelerator - update to 2.3.4
IBM Intelligent Operations Center - update to 5.2.4
watsonx.data integration - update to 5.3.1
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF14
DevOps Test Performance - update to 11.0.8
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
IBM Security SOAR - update to 51.0.10.2
IBM Cloud Transformation Advisor - update to 1.9.6
IBM Process Mining - update to 1.12.0.4
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
IBM Security Verify Governance - update to 10.0.1.0.5

• https://hackerone.com/reports/380873

• Multiple vulnerabilities in lodash
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Prototype pollution in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in IBM Business Automation Insights
• IBM watsonx Orchestrate Developer Edition update for lodash
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM watsonx.data integration
• Multiple vulnerabilities in IBM DevOps Test Performance
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Security SOAR