Prototype pollution in plotly.js - CVE-2023-46308
Published: February 13, 2024
Vulnerability identifier: #VU86374
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-46308
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.
Affected software
plotly.js
DataPower Operations Dashboard
QRadar Suite
QRadar Pulse App
IBM Maximo Asset Management
DataPower Operations Dashboard
QRadar Suite
QRadar Pulse App
IBM Maximo Asset Management
How to mitigate CVE-2023-46308
Install updates from vendor's website.
plotly.js - update to 2.25.2
DataPower Operations Dashboard - update to 1.0.20.1
QRadar Suite - update to 1.10.18.0
QRadar Pulse App - update to 2.2.12
IBM Maximo Asset Management - update to 7.6.1.3.25
DataPower Operations Dashboard - update to 1.0.20.1
QRadar Suite - update to 1.10.18.0
QRadar Pulse App - update to 2.2.12
IBM Maximo Asset Management - update to 7.6.1.3.25