CVE-2020-28472

Prototype Pollution

High · published January 19, 2021

CVSS v3.1
7.3
EPSS
2%
Percentile
82.1
In the wild
Unconfirmed
What it is

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
CVSS v4.0
Not supplied
EPSS
0.02168 · 82.1th percentile
Published
2021-01-19T10:25Z
EPSS history
Timeline
  • 19 JAN 10:25Z
    Prototype Pollution
    cvelistv5