NetSight
IP …
critical9.1

CVE-2019-10744

Prototype Pollution in lodash

Impact

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution. The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects. ## Recommendation Update to version 4.17.12 or later.

Affected packages

EcosystemPackageAffectedFixed in
npmlodash< 4.17.124.17.12
npmlodash-es< 4.17.144.17.14
npmlodash-amd< 4.17.134.17.13
npmlodash.defaultsdeep< 4.6.14.6.1
rubygemslodash-rails< 4.17.124.17.12

Affected products

VendorProductAffected versions
LodashLodash
before 4.17.12
NetappActive Iq Unified Manager
All versions
NetappService Level Manager
All versions
RedhatVirtualization Manager
Version 4.3
OracleBanking Extensibility Workbench
Versions 14.3.0, 14.4.0
F5Big-Ip Access Policy Manager
from 12.1.0 before 12.1.5.2
from 13.1.0 before 13.1.3.4
from 14.1.0 before 14.1.2.5
from 15.0.0 before 15.0.1.4
from 15.1.0 before 15.1.0.2
F5Big-Ip Advanced Firewall Manager
from 12.1.0 before 12.1.5.2
from 13.1.0 before 13.1.3.4
from 14.1.0 before 14.1.2.5
from 15.0.0 before 15.0.1.4
from 15.1.0 before 15.1.0.2
F5Big-Ip Analytics
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
from 14.1.0 through 14.1.2
from 15.0.0 before 15.0.1.3
from 15.1.0 before 15.1.0.2
F5Big-Ip Application Acceleration Manager
from 12.1.0 before 12.1.5.2
from 13.1.0 before 13.1.3.4
from 14.1.0 before 14.1.2.5
from 15.0.0 before 15.0.1.4
from 15.1.0 before 15.1.0.2
F5Big-Ip Application Security Manager
from 12.1.0 before 12.1.5.2
from 13.1.0 before 13.1.3.4
from 14.1.0 before 14.1.2.5
from 15.0.0 before 15.0.1.4
from 15.1.0 before 15.1.0.2
F5Big-Ip Application Visibility And Reporting
from 12.1.0 before 12.1.5.2
from 13.1.0 through 13.1.3
from 14.1.0 before 14.1.2.5
from 15.1.0 before 15.1.1
F5Big-Ip Domain Name System
from 12.1.0 before 12.1.5.2
from 13.1.0 before 13.1.3.4
from 14.1.0 before 14.1.2.5
from 15.0.0 before 15.0.1.4
from 15.1.0 before 15.1.0.2

Weakness classification

CWE-1321CWE-20

References