by Kastro
Paper/Archive/CVE-2020-7788

CVE-2020-7788

snyk — Prototype Pollution

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.6.896 × 2017.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected

ProductAffectedFixed inSource
iniunspecified – < 1.3.61.3.6CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsnyk.io/vuln/SNYK-JS-INI-1048974refgithub.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1reflists.debian.org/debian-lts-announce/2020/12/msg00032.html