Code Injection in utils-extend - #VU28104

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28104

Code Injection in utils-extend - #VU28104

Published: May 20, 2020 / Updated: May 20, 2020


Vulnerability identifier: #VU28104
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
utils-extend
Software vendor:
douzi8

Description

The disclosed vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to insufficient sanitization of user-supplied data. The extend function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. A remote attacker can inject and execute arbitrary script code.


Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links