Prototype Pollution
CVE-2020-7720

9.8CRITICAL

Key Information:

Vendor

Digitalbazaar

Status
Node-forge
Vendor
CVE Published:
1 September 2020

What is CVE-2020-7720?

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Affected Version(s)

node-forge 0

References

https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293
x_refsource_MISC
https://github.com/digitalbazaar/forge/blob/master/CHANGE...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NerdJS
.