CVE-2018-16472

A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.
References
Link Resource
https://hackerone.com/reports/390847 Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cached-path-relative_project:cached-path-relative:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

03 Feb 2023, 18:57

Type Values Removed Values Added
First Time Debian
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html - Mailing List, Third Party Advisory

05 Dec 2022, 02:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html -

Information

Published : 2018-11-06 19:29

Updated : 2023-12-10 12:44


NVD link : CVE-2018-16472

Mitre link : CVE-2018-16472

CVE.ORG link : CVE-2018-16472


JSON object : View

Products Affected

debian

  • debian_linux

cached-path-relative_project

  • cached-path-relative
CWE
CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption