2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:merge-options_project:merge-options:*:*:*:*:*:node.js:*:*","matchCriteriaId":"86705A8D-EC19-4D02-B053-6DDDAD22C8A2","versionEndIncluding":"1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects."},{"lang":"es","value":"La función utilities en todas las versiones anteriores o iguales a la 1.0.0 del módulo merge-options se puede engañar para que modifique el prototipo de Object cuando el atacante puede controlar parte de la estructura pasada a esta función. Esto puede permitir que un atacante añada o modifique propiedades existentes que existirán en todos los objetos."}],"id":"CVE-2018-3752","lastModified":"2026-06-17T01:57:46.300","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-07-03T21:29:00.700","references":[{"source":"support@hackerone.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://hackerone.com/reports/311336"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://hackerone.com/reports/311336"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"nvd@nist.gov","type":"Primary"}]}
|