Vulnerabilities > CVE-2020-15256 - Unspecified vulnerability in Object-Path Project Object-Path

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

object-path-project

critical

NVD

Published: 2020-10-19

Updated: 2024-11-21

Summary

A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.

Vulnerable Configurations

Part	Description	Count
Application	Object-Path_Project Object Path Project Object Path 0.0.1 Object Path Project Object Path 0.1.0 Object Path Project Object Path 0.1.2 Object Path Project Object Path 0.1.3 Object Path Project Object Path 0.2.0 Object Path Project Object Path 0.2.1 Object Path Project Object Path 0.3.0 Object Path Project Object Path 0.4.0 Object Path Project Object Path 0.5.0 Object Path Project Object Path 0.5.1 Object Path Project Object Path 0.6.0 Object Path Project Object Path 0.7.0 Object Path Project Object Path 0.8.0 Object Path Project Object Path 0.8.1 Object Path Project Object Path 0.9.0 Object Path Project Object Path 0.9.1 Object Path Project Object Path 0.9.2 Object Path Project Object Path 0.9.3 Object Path Project Object Path 0.10.0 Object Path Project Object Path 0.11.0 Object Path Project Object Path 0.11.1 Object Path Project Object Path 0.11.2 Object Path Project Object Path 0.11.3 Object Path Project Object Path 0.11.4	24

Summary

Vulnerable Configurations

References