CVE-2020-7600

querymen prior to 2.1.4 allows modification of object properties

published March 12, 2020

CVSS
—
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01156 · 66.8th percentile
Published
2020-03-12T22:25Z
EPSS history
Timeline
  • 12 MAR 22:25Z
    querymen prior to 2.1.4 allows modification of object properties
    cvelistv5