by Kastro
Paper/Archive/CVE-2020-7770

CVE-2020-7770

snyk — Prototype Pollution

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.6.796 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.

Affected

ProductAffectedFixed inSource
json8unspecified – < 1.0.31.0.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

refsnyk.io/vuln/SNYK-JS-JSON8-1017116refgithub.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e