by Kastro
Paper/Archive/CVE-2023-26136

CVE-2023-26136

snyk — Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using Co…

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.5.855 × 2017.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Affected

ProductAffectedFixed inSource
tough-cookie< 4.1.34.1.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refsecurity.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873refgithub.com/salesforce/tough-cookie/issues/282refgithub.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6erefgithub.com/salesforce/tough-cookie/releases/tag/v4.1.3reflists.debian.org/debian-lts-announce/2023/07/msg00010.htmlreflists.fedoraproject.org/archives/list/[email protected]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZreflists.fedoraproject.org/archives/list/[email protected]/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2refsecurity.netapp.com/advisory/ntap-20240621-0006