Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-41713

Good to know:

icon
icon

Date: November 2, 2022

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited.

Language: JS

Severity Score

Related Resources (9)

https://nvd.nist.gov/vuln/detail/CVE-2022-41713
https://github.com/mattphillips/deep-object-diff/pull/87/commits/9576963b68b955e88610aa4f0c696a1aafc1119d
https://github.com/mattphillips/deep-object-diff
https://fluidattacks.com/advisories/heldens/
https://fluidattacks.com/advisories/heldens
https://github.com/mattphillips/deep-object-diff/issues/85#issuecomment-1312450353
https://github.com/mattphillips/deep-object-diff/issues/85
https://github.com/mattphillips/deep-object-diff/pull/87/commits/55f9c3c70cf0d54cb30291e949fb8682fa3c5d9f
https://www.mend.io/vulnerability-database/CVE-2022-41713

Severity Score

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

icon

Upgrade Version

Upgrade to version deep-object-diff - 1.1.9

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us