Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2023-0842

Good to know:

icon

Date: April 4, 2023

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

Language: JS

Severity Score

Related Resources (11)

https://access.redhat.com/security/cve/CVE-2023-0842
https://nvd.nist.gov/vuln/detail/CVE-2023-0842
https://github.com/Leonidas-from-XIV/node-xml2js/
https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html
https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5
https://fluidattacks.com/advisories/myers/
https://fluidattacks.com/advisories/myers
https://security-tracker.debian.org/tracker/CVE-2023-0842
https://github.com/Leonidas-from-XIV/node-xml2js/issues/663
https://github.com/Leonidas-from-XIV/node-xml2js
https://www.mend.io/vulnerability-database/CVE-2023-0842

Severity Score

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

icon

Upgrade Version

Upgrade to version xml2js - 0.5.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us