Prototype Pollution in yargs-parser - CVE-2020-7608

Vulnerability identifier: #VU26304

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7608

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and add or modify properties of Object.prototype using a "__proto__" payload.

yargs-parser
Cloud Pak for Security (CP4S)
IBM Watson Machine Learning Accelerator
Business Automation Insights
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
IBM Cloud Pak for Business Automation
rh-nodejs10-nodejs (Red Hat package)

Install updates from vendor's website.

yargs-parser - addressed in versions 13.1.2, 15.0.1, 18.1.1
Cloud Pak for Security (CP4S) - update to 1.10.7.0
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7

• https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

• Prototype Pollution in yargs-parser library
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation