CVE-2018-3750 High Severity Vulnerability detected by WhiteSource
mend-bolt-for-github opened this issue · comments
CVE-2018-3750 - High Severity Vulnerability
Vulnerable Library - deep-extend-0.4.2.tgz
Recursive object extending
path: null
Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.2.tgz
Dependency Hierarchy:
- browser-sync-2.23.6.tgz (Root Library)
- chokidar-1.7.0.tgz
- fsevents-1.1.3.tgz
- node-pre-gyp-0.6.39.tgz
- rc-1.2.1.tgz
- ❌ deep-extend-0.4.2.tgz (Vulnerable Library)
- rc-1.2.1.tgz
- node-pre-gyp-0.6.39.tgz
- fsevents-1.1.3.tgz
- chokidar-1.7.0.tgz
Vulnerability Details
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Publish Date: 2018-07-03
URL: CVE-2018-3750
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Change files
Origin: RetireJS/retire.js@6a71696
Release Date: 2018-05-09
Fix Resolution: Replace or update the following file: npmrepository.json
Step up your Open Source Security Game with WhiteSource here