Modification of Assumed-Immutable Data in Defaults-Deep Node Module by Jonschlinkert
CVE-2018-3723

8.8HIGH

Key Information:

Vendor

Hackerone

Status
Defaults-deep Node Module
Vendor
CVE Published:
7 June 2018

What is CVE-2018-3723?

The defaults-deep node module, prior to version 0.2.4, is susceptible to a Modification of Assumed-Immutable Data (MAID) vulnerability. This flaw enables malicious actors to modify the 'Object' prototype through the proto property, which can lead to unauthorized changes or additions to properties that subsequently impact all objects in the application. Such alterations can have significant implications for application behavior and security, allowing for potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

defaults-deep node module Versions before 0.2.4

References

https://github.com/jonschlinkert/defaults-deep/commit/c87...
x_refsource_MISC
https://hackerone.com/reports/310514
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.