Home > Vulnerability Database > CVE-2020-7598

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-7598

Good to know:

Date: March 11, 2020

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Language: Java

Severity Score

5.6

Related Resources (25)

Url: https://access.redhat.com/security/cve/CVE-2020-7598

Url: https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068

Url: https://www.npmjs.com/advisories/1179

Url: https://github.com/advisories/GHSA-6chw-6frg-f759

Url: https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-7598

Url: https://github.com/minimistjs/minimist/pull/24

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-44906

Url: https://github.com/substack/minimist/issues/164

Url: https://github.com/minimistjs/minimist/commits/v0.2.4

Url: https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68

Url: https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d

Url: https://github.com/substack/minimist

Url: https://github.com/substack/minimist/blob/master/index.js#L69

Url: https://github.com/advisories/GHSA-vh95-rmgr-6w4m

Url: https://security.netapp.com/advisory/ntap-20240621-0006

Url: https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Url: https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95

Url: https://github.com/minimistjs/minimist/issues/11

Url: https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703

Url: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip

Url: https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab

Url: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

Url: https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11

Url: https://www.mend.io/vulnerability-database/CVE-2020-7598

Severity Score

5.6

Weakness Type (CWE)

Input Validation

CWE-20

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version 1.2.2

CVSS v3.1

Base Score:	5.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.8
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us