Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2019:3024 | Third Party Advisory |
https://security.netapp.com/advisory/ntap-20191004-0005/ | Third Party Advisory |
https://snyk.io/vuln/SNYK-JS-LODASH-450202 | Exploit Third Party Advisory |
https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS | Third Party Advisory |
https://www.oracle.com/security-alerts/cpujan2021.html | Patch Third Party Advisory |
https://www.oracle.com/security-alerts/cpuoct2020.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Jan 2024, 02:45
Type | Values Removed | Values Added |
---|---|---|
References | () https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS - Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpujan2021.html - Patch, Third Party Advisory | |
References | () https://www.oracle.com/security-alerts/cpuoct2020.html - Patch, Third Party Advisory | |
CPE | cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* |
|
First Time |
Netapp active Iq Unified Manager
|
|
CWE | CWE-1321 |
07 Nov 2023, 03:02
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
16 Mar 2021, 13:57
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 9.1 |
References | (CONFIRM) https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS - Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Third Party Advisory | |
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20191004-0005/ - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2019:3024 - Third Party Advisory | |
References | (MISC) https://www.oracle.com/security-alerts/cpujan2021.html - Third Party Advisory | |
CWE | NVD-CWE-Other |
20 Jan 2021, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2019-07-26 00:15
Updated : 2024-01-21 02:45
NVD link : CVE-2019-10744
Mitre link : CVE-2019-10744
CVE.ORG link : CVE-2019-10744
JSON object : View
Products Affected
oracle
- banking_extensibility_workbench
f5
- big-ip_application_security_manager
- big-iq_centralized_management
- big-ip_application_acceleration_manager
- big-ip_edge_gateway
- big-ip_local_traffic_manager
- big-ip_domain_name_system
- big-ip_analytics
- big-ip_access_policy_manager
- big-ip_webaccelerator
- big-ip_fraud_protection_service
- big-ip_application_visibility_and_reporting
- big-ip_advanced_firewall_manager
- big-ip_policy_enforcement_manager
- big-ip_link_controller
- iworkflow
- big-ip_global_traffic_manager
redhat
- virtualization_manager
netapp
- service_level_manager
- active_iq_unified_manager
lodash
- lodash
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')