What is GHSA-v3r2-3fp4-rp46?

GHSA-v3r2-3fp4-rp46 is a security advisory published by GitHub Security Advisories with Medium severity. Prototype pollution in paypal-adaptive

Which CVE IDs does GHSA-v3r2-3fp4-rp46 cover?

GHSA-v3r2-3fp4-rp46 covers the following CVE IDs: CVE-2020-7643. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v3r2-3fp4-rp46?

GHSA-v3r2-3fp4-rp46 has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-v3r2-3fp4-rp46?

GHSA-v3r2-3fp4-rp46 affects 1 product, including: npm/paypal-adaptive:\u003c= 0.4.2.

GHSA-v3r2-3fp4-rp46MediumCVSS 4.2

Prototype pollution in paypal-adaptive

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

September 6, 2023

🔗 CVE IDs covered (1)

CVE-2020-7643 →

📋 Description

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.

🎯 Affected products1

npm/paypal-adaptive:<= 0.4.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-7643
https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31
https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089
https://github.com/advisories/GHSA-v3r2-3fp4-rp46