by Kastro
Paper/Archive/CVE-2020-36618

CVE-2020-36618

Furqan node-whois — Furqan node-whois index.coffee prototype pollution

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.0.630 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.

Affected

ProductAffectedFixed inSource
node-whoisn/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/FurqanSoftware/node-whois/pull/105refgithub.com/FurqanSoftware/node-whois/commit/46ccc2aee8d063c7b6b4dee2c2834113b7286076refvuldb.com/?id.216252