CVE-2020-8203

Published: Jul 15, 2020Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Affected (42)

Products: Lodash: Lodash · Oracle: Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Extensibility Workbench, Banking Liquidity Management, Banking Supply Chain Finance, Banking Trade Finance Process Management, Banking Virtual Account Management, Blockchain Platform, Communications Billing And Revenue Management, Communications Cloud Native Core Policy, Communications Session Border Controller, Communications Session Router, Communications Subscriber Aware Load Balancer, Enterprise Communications Broker, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools, Primavera Gateway

1 product

17 products

Banking Corporate Lending Process Management

Banking Credit Facilities Process Management

Banking Extensibility Workbench

Banking Liquidity Management

Banking Supply Chain Finance

Banking Trade Finance Process Management

Banking Virtual Account Management

Blockchain Platform

Communications Billing And Revenue Management

Communications Cloud Native Core Policy

Communications Session Border Controller

Communications Session Router

Communications Subscriber Aware Load Balancer

Enterprise Communications Broker

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Primavera Gateway

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lodash Lodash	Before 4.17.20

Configuration B

41 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Corporate Lending Process Management	Version 14.2.0
Oracle Banking Corporate Lending Process Management	Version 14.3.0
Oracle Banking Corporate Lending Process Management	Version 14.5.0
Oracle Banking Credit Facilities Process Management	Version 14.2.0
Oracle Banking Credit Facilities Process Management	Version 14.3.0
Oracle Banking Credit Facilities Process Management	Version 14.5.0
Oracle Banking Extensibility Workbench	Version 14.2.0
Oracle Banking Extensibility Workbench	Version 14.3.0
Oracle Banking Extensibility Workbench	Version 14.5.0
Oracle Banking Liquidity Management	Version 14.2.0
Oracle Banking Liquidity Management	Version 14.3.0
Oracle Banking Liquidity Management	Version 14.5.0
Oracle Banking Supply Chain Finance	Version 14.2.0
Oracle Banking Supply Chain Finance	Version 14.3.0
Oracle Banking Supply Chain Finance	Version 14.5.0
Oracle Banking Trade Finance Process Management	Version 14.2.0
Oracle Banking Trade Finance Process Management	Version 14.3.0
Oracle Banking Trade Finance Process Management	Version 14.5.0
Oracle Banking Virtual Account Management	Version 14.2.0
Oracle Banking Virtual Account Management	Version 14.3.0
Oracle Banking Virtual Account Management	Version 14.5.0
Oracle Blockchain Platform	Before 21.1.2
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Billing And Revenue Management	Version 7.5.0.23.0
Oracle Communications Cloud Native Core Policy	Version 1.11.0
Oracle Communications Session Border Controller	Version 8.4
Oracle Communications Session Border Controller	Version 9.0
Oracle Communications Session Border Controller	Version cz8.4
Oracle Communications Session Router	Version cz8.4
Oracle Communications Subscriber Aware Load Balancer	Version cz8.3
Oracle Communications Subscriber Aware Load Balancer	Version cz8.4
Oracle Enterprise Communications Broker	Version 3.2.0
Oracle Enterprise Communications Broker	Version 3.3.0
Oracle Enterprise Communications Broker	Version pcz3.3
Oracle Jd Edwards Enterpriseone Tools	Up to 9.2.6.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Peoplesoft Enterprise Peopletools	Version 8.59
Oracle Primavera Gateway	From 17.12.0 to 17.12.11
Oracle Primavera Gateway	From 18.8.0 to 18.8.12
Oracle Primavera Gateway	From 19.12.0 to 19.12.11
Oracle Primavera Gateway	From 20.12.0 to 20.12.7

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (16)

https://github.com/lodash/lodash/issues/4874

Source: support@hackerone.com

Issue TrackingVendor Advisory

https://hackerone.com/reports/712065

Source: support@hackerone.com

ExploitThird Party Advisory

https://security.netapp.com/advisory/ntap-20200724-0006/

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: support@hackerone.com

PatchThird Party Advisory

https://github.com/lodash/lodash/issues/4874

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://hackerone.com/reports/712065

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://security.netapp.com/advisory/ntap-20200724-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.