CVE-2020-5258
HighCVSS 7.7Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2.
Risk Assessment
Prototype pollution can lead to unpredictable application behavior, bypass of security mechanisms, and in some cases remote code execution. The risk affects applications using the dojo library to process input data.
Recommendation
Update the dojo library to version 1.12.8, 1.13.7, 1.14.6, 1.15.3, or 1.16.2 (or newer). Verify that the application does not process untrusted data through the deepCopy method.
Other vulnerabilities in dojo
Original NVD description (English source)
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability data from NVD (NIST) · CISA KEV · EPSS