NetSight
IP …
high7.7

CVE-2020-5258

Prototype pollution in dojo

Impact

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

Affected packages

EcosystemPackageAffectedFixed in
npmdojo< 1.11.101.11.10

Affected products

VendorProductAffected versions
LinuxfoundationDojo
before 1.11.10
from 1.12.0 before 1.12.8
from 1.13.0 before 1.13.7
from 1.14.0 before 1.14.6
from 1.15.0 before 1.15.3
from 1.16.0 before 1.16.2
DebianDebian Linux
Version 8.0
OracleCommunications Application Session Controller
Version 3.9.0
OracleCommunications Policy Management
Version 12.5.0
OracleCommunications Pricing Design Center
Version 12.0.0.3.0
OracleDocumaker
from 12.6.0 through 12.6.4
OracleMysql
from 7.3.0 through 7.3.29
from 7.4.0 through 7.4.28
from 7.5.0 through 7.5.18
from 7.6.0 through 7.6.14
from 8.0.0 through 8.0.20
OraclePrimavera Unifier
from 17.7 through 17.12
Versions 18.8, 19.12, 20.12
OracleWebcenter Sites
Versions 12.2.1.3.0, 12.2.1.4.0
OracleWeblogic Server
Versions 12.2.1.4.0, 14.1.1.0.0

Weakness classification

CWE-94CWE-1321CWE-74

References