Prototype pollution in rangy - CVE-2023-26102

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU96657

Prototype pollution in rangy - CVE-2023-26102

Published: September 2, 2024 / Updated: November 6, 2024


Vulnerability identifier: #VU96657
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26102
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in extend() function in file rangy-core.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.


Affected software

rangy
Planning Analytics Local

How to mitigate CVE-2023-26102

Install update from vendor's website.

rangy - update to 1.3.2
Planning Analytics Local - update to 2.1.5

External References

Related Security Bulletins