VulnerabilityModified
CVE-2020-15366
A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution.
MEDIUM 5.6EPSS 2.29%
Does this matter?
Lower severity and a low EPSS score (2.29%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
- CVSS 3.1
- 5.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- EPSS
- 2.29% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1321
- Affected
- ajv.js/ajv
- Source
- cve@mitre.org
References
- https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release Notes, Third Party Advisory
- https://github.com/ajv-validator/ajv/tagsThird Party Advisory
- https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release Notes, Third Party Advisory
- https://github.com/ajv-validator/ajv/tagsThird Party Advisory
- https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
- https://security.netapp.com/advisory/ntap-20240621-0007/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.