Home > Vulnerability Database > CVE-2020-7743

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2020-7743

Good to know:

Date: October 13, 2020

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

Language: JS

Severity Score

7.3

Related Resources (6)

Url: https://github.com/josdejong/mathjs/blob/develop/HISTORY.md#2020-10-10-version-751

Url: https://www.npmjs.com/package/mathjs

Url: https://github.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82

Url: https://github.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-7743

Url: https://www.mend.io/vulnerability-database/CVE-2020-7743

Severity Score

7.3

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-915

Top Fix

Upgrade Version

Upgrade to version 7.5.1

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us