CVE-2020-8203

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Score

CVSS 3.1 7.4 High

Status

Modified - support@hackerone.com

Published

2020-07-15

Last modified

2024-08-04

Weaknesses

CWE-1321, CWE-770

Affected products

• Lodash (Lodash)
• Banking Corporate Lending Process Management (Oracle)
• Banking Credit Facilities Process Management (Oracle)
• Banking Extensibility Workbench (Oracle)
• Banking Liquidity Management (Oracle)
• Banking Supply Chain Finance (Oracle)
• Banking Trade Finance Process Management (Oracle)
• Banking Virtual Account Management (Oracle)
• Blockchain Platform (Oracle)
• Communications Billing And Revenue Management (Oracle)
• Communications Cloud Native Core Policy (Oracle)
• Communications Session Border Controller (Oracle)
• Communications Session Router (Oracle)
• Communications Subscriber-aware Load Balancer (Oracle)
• Enterprise Communications Broker (Oracle)
• Jd Edwards Enterpriseone Tools (Oracle)
• Peoplesoft Enterprise Peopletools (Oracle)
• Primavera Gateway (Oracle)

References

• https://github.com/lodash/lodash/issues/4874
• https://hackerone.com/reports/712065
• https://security.netapp.com/advisory/ntap-20200724-0006/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html