CVE-2018-3752

{"id": "CVE-2018-3752", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-07-03T21:29:00.700", "references": [{"url": "https://hackerone.com/reports/311336", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects."}, {"lang": "es", "value": "La funci\u00f3n utilities en todas las versiones anteriores o iguales a la 1.0.0 del m\u00f3dulo merge-options se puede enga\u00f1ar para que modifique el prototipo de Object cuando el atacante puede controlar parte de la estructura pasada a esta funci\u00f3n. Esto puede permitir que un atacante a\u00f1ada o modifique propiedades existentes que existir\u00e1n en todos los objetos."}], "lastModified": "2018-08-23T13:13:14.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:merge-options_project:merge-options:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "86705A8D-EC19-4D02-B053-6DDDAD22C8A2", "versionEndIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}