Code Injection in Lodash - CVE-2019-10744

Vulnerability identifier: #VU21764

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10744

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify properties on the target system.

The vulnerability exists due to improper input validation in the "defaultsDeep" function. A remote attacker can send a specially crafted request and modify the prototype of "Object" via "{constructor: {prototype: {...}}}" causing the addition or modification of an existing property that will exist on all objects.

Lodash
QRadar Pulse App
Oracle Banking Extensibility Workbench
IBM Cloud Transformation Advisor
IBM Intelligent Operations Center
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Cloud Pak for Business Automation
IBM Process Mining
IBM Security Verify Governance
IBM Watson Machine Learning Accelerator
Rational Performance Tester
DevOps Test Performance
Business Automation Insights
QRadar Assistant
MobileFirst Platform
AMQ Broker
Fuse
Orion Platform

Install updates from vendor's website.

Lodash - update to 4.17.12
QRadar Pulse App - update to 2.2.9
IBM Watson Machine Learning Accelerator - update to 2.3.4
IBM Intelligent Operations Center - update to 5.2.4
AMQ Broker - update to 7.10.0
DevOps Test Performance - update to 11.0.8
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Orion Platform - update to 2024.4
IBM Process Mining - update to 1.12.0.4
QRadar Assistant - update to 3.6.0
Fuse - update to 7.10.0
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
IBM Security Verify Governance - update to 10.0.1.0.5

• https://snyk.io/vuln/SNYK-JS-LODASH-450202

• Code injection in Lodash component for Node.js
• Multiple vulnerabilities in Oracle Banking Extensibility Workbench
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in IBM Process Mining
• Code Injection in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in SolarWinds Orion Platform
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM QRadar Assistant
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM DevOps Test Performance