CVE-2018-3721
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Modified - support@hackerone.com
- Published
- 2018-06-07
- Last modified
- 2024-09-16
- Weaknesses
- CWE-1321, CWE-471
Affected products
- Lodash Node Module (Hackerone)
- Lodash (Lodash)
- Active Iq Unified Manager (Netapp)
- System Manager (Netapp)
References
- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
- https://hackerone.com/reports/310443
- https://security.netapp.com/advisory/ntap-20190919-0004/
