CVE-2020-7788CWE-1321

CVE-2020-7788

High · published December 11, 2020

CVSS v3.1
7.3
EPSS
4%
Percentile
89.6
In the wild
Unconfirmed
What it is

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03655 · 89.6th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2020-12-11T16:15Z
Affected products (2)
ProductVersionsFixed in
ini_project/ini< 1.3.61.3.6
debian/debian_linuxall versions—
References (6)
https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 · [email protected]https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html · [email protected]https://snyk.io/vuln/SNYK-JS-INI-1048974 · [email protected]https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JS-INI-1048974 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 11 DEC 10:45Z
    Prototype Pollution
    cvelistv5