Main Vulnerability Database Vulnerabilities #VU85028

Prototype pollution in merge - CVE-2020-28499

Published: January 5, 2024

Vulnerability identifier: #VU85028

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28499

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation via _recursiveMerge. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Affected software

merge
IBM Watson Machine Learning Accelerator

How to mitigate CVE-2020-28499

Install update from vendor's website.

merge - update to 2.1.1

External References

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049
https://github.com/yeikos/js.merge/blob/master/src/index.ts%23L64
https://snyk.io/vuln/SNYK-JS-MERGE-1042987
https://vuldb.com/?id.170146

Related Security Bulletins