VulnerabilityModified
CVE-2020-8203
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
HIGH 7.4EPSS 5.21%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
- CVSS 3.1
- 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS
- 5.21% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770, CWE-1321
- Affected
- lodash/lodash · oracle/banking corporate lending process management · oracle/banking credit facilities process management · oracle/banking extensibility workbench · oracle/banking liquidity management · oracle/banking supply chain finance · oracle/banking trade finance process management · oracle/banking virtual account management · oracle/blockchain platform · oracle/communications billing and revenue management · oracle/communications cloud native core policy · oracle/communications session border controller · oracle/communications session router · oracle/communications subscriber-aware load balancer · oracle/enterprise communications broker · oracle/jd edwards enterpriseone tools · oracle/peoplesoft enterprise peopletools · oracle/primavera gateway
- Source
- support@hackerone.com
References
- https://github.com/lodash/lodash/issues/4874Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/712065Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200724-0006/Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://github.com/lodash/lodash/issues/4874Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/712065Exploit, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200724-0006/Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.