Prototype pollution in minimist - CVE-2020-7598

Vulnerability identifier: #VU26151

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2020-7598

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
minimist
IBM Engineering Requirements Quality Assistant
IBM Watson Machine Learning Accelerator
IBM Planning Analytics Workspace
Cognos Dashboards on Cloud Pak for Data
QRadar Pulse App
Cloud Pak for Security (CP4S)
IBM QRadar Data Synchronization App
Red Hat OpenShift Container Platform
IBM Intelligent Operations Center
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Opensuse
openEuler
rh-nodejs10-nodejs (Red Hat package)
nodejs-minimist
rh-nodejs12-nodejs (Red Hat package)
IBM Security QRadar Analyst Workflow
IBM Cognos Analytics

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

The vendor has issued the following versions to address this vulnerability: 1.2.3.

• https://www.npmjs.com/advisories/1179