This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
References
| Link | Resource |
|---|---|
| https://security.snyk.io/vuln/SNYK-JS-IONPARSER-1048971 | Exploit Third Party Advisory |
Configurations
History
01 Aug 2022, 13:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:ion-parser_project:ion-parser:*:*:*:*:*:node.js:*:* | |
| CWE | CWE-1321 | |
| References | (CONFIRM) https://security.snyk.io/vuln/SNYK-JS-IONPARSER-1048971 - Exploit, Third Party Advisory | |
| First Time |
Ion-parser Project ion-parser
Ion-parser Project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
25 Jul 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-25 14:15
Updated : 2023-12-10 14:35
NVD link : CVE-2020-28462
Mitre link : CVE-2020-28462
CVE.ORG link : CVE-2020-28462
JSON object : View
Products Affected
ion-parser_project
- ion-parser
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')