← Back

CVE-2020-5258

nvd nist
Published: Mar 10, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD (Secondary)

Description

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Affected (24)

Linuxfoundation
1 product
Dojo
Debian
1 product
Debian Linux
Oracle
8 products
Communications Application Session Controller
Communications Policy Management
Communications Pricing Design Center
Documaker
Mysql
Primavera Unifier
Webcenter Sites
Weblogic Server
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Linuxfoundation
Dojo
Before 1.11.10
Dojo
From 1.12.0 to 1.12.8
Dojo
From 1.13.0 to 1.13.7
Dojo
From 1.14.0 to 1.14.6
Dojo
From 1.15.0 to 1.15.3
Dojo
From 1.16.0 to 1.16.2
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 8.0
Configuration C
17 vulnerable
Vulnerable SoftwareAffected Versions
Communications Application Session Controller
Version 3.9.0
Communications Policy Management
Version 12.5.0
Communications Pricing Design Center
Version 12.0.0.3.0
Documaker
From 12.6.0 to 12.6.4
Oracle
Mysql
From 7.3.0 to 7.3.29
Mysql
From 7.4.0 to 7.4.28
Mysql
From 7.5.0 to 7.5.18
Mysql
From 7.6.0 to 7.6.14
Mysql
From 8.0.0 to 8.0.20
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Primavera Unifier
Version 20.12
Oracle
Webcenter Sites
Version 12.2.1.3.0
Webcenter Sites
Version 12.2.1.4.0
Oracle
Weblogic Server
Version 12.2.1.4.0
Weblogic Server
Version 14.1.1.0.0

Related CWEs

CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (22)

Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
ExploitThird Party Advisory
Source: security-advisories@github.com
Source: security-advisories@github.com
Source: security-advisories@github.com
Source: security-advisories@github.com
Mailing ListThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Source: security-advisories@github.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.