CVE-2023-26136CWE-1321

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in…

Medium · published July 1, 2023

CVSS v3.1
6.5
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.02627 · 85.4th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2023-07-01T05:00Z
EPSS history
Timeline
  • 01 JUL 05:00Z
    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in…
    cvelistv5