CVE-2023-26113

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26113
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 Broken Link
https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 Patch
https://github.com/kobezzza/Collection/issues/27 Exploit Issue Tracking Patch Third Party Advisory
https://github.com/kobezzza/Collection/releases/tag/v6.8.1 Patch Release Notes
https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 Exploit Technical Description Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:collection.js_project:collection.js:*:*:*:*:*:node.js:*:*
History

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js. Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

24 Mar 2023, 02:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:collection.js_project:collection.js:*:*:*:*:*:node.js:*:*
First Time Collection.js Project
Collection.js Project collection.js
References (MISC) https://github.com/kobezzza/Collection/issues/27 - (MISC) https://github.com/kobezzza/Collection/issues/27 - Exploit, Issue Tracking, Patch, Third Party Advisory
References (MISC) https://github.com/kobezzza/Collection/releases/tag/v6.8.1 - (MISC) https://github.com/kobezzza/Collection/releases/tag/v6.8.1 - Patch, Release Notes
References (MISC) https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 - (MISC) https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 - Exploit, Technical Description, Third Party Advisory
References (MISC) https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 - (MISC) https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 - Patch
References (MISC) https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 - (MISC) https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 - Broken Link
CWE CWE-1321

18 Mar 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-18 05:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-26113

Mitre link : CVE-2023-26113

CVE.ORG link : CVE-2023-26113

JSON object : View

Products Affected

collection.js_project

  • collection.js
CWE
CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')