Vulnerability identifier: #VU24833

Vulnerability risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-8116

CWE-ID: CWE-400

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
dot-prop
Web applications / Modules and components for CMS

Vendor: Sindre Sorhus

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to prototype pollution. A remote authenticated attacker can modify the prototype of a base object which can vary in severity depending on the implementation (DoS, access to sensitive data, RCE).

Mitigation
Install updates from vendor's website.

Vulnerable software versions

dot-prop: 1.0.0 - 5.1.0

---

External links
http://snyk.io/vuln/SNYK-JS-DOTPROP-543489
http://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2
http://hackerone.com/reports/719856

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.