What is GHSA-jgpq-g82g-6c39?

GHSA-jgpq-g82g-6c39 is a security advisory published by GitHub Security Advisories with Medium severity. confinit vulnerable to prototype pollution

Which CVE IDs does GHSA-jgpq-g82g-6c39 cover?

GHSA-jgpq-g82g-6c39 covers the following CVE IDs: CVE-2020-7638. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jgpq-g82g-6c39?

GHSA-jgpq-g82g-6c39 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-jgpq-g82g-6c39?

GHSA-jgpq-g82g-6c39 affects 1 product, including: npm/confinit:\u003c 0.4.0.

GHSA-jgpq-g82g-6c39MediumCVSS 5.3

confinit vulnerable to prototype pollution

Vendor

GitHub Security Advisories

Published

April 7, 2020

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-7638 →

📋 Description

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.

🎯 Affected products1

npm/confinit:< 0.4.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-7638
https://github.com/davideicardi/confinit/commit/a34e06ca5c1c8b047ef112ef188b2fe30d2a1eab
https://snyk.io/vuln/SNYK-JS-CONFINIT-564433
https://github.com/advisories/GHSA-jgpq-g82g-6c39