GHSA-rc4v-99cr-pjcm

    Dashboard / Vulnerabilities / GHSA-rc4v-99cr-pjcm

    GHSA-rc4v-99cr-pjcm

    Published: 17 Oct 2023Last Modified: 17 Oct 2023

    Summary: Prototype Pollution in ali-security/mongoose

    Details: ### Impact This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate(). For applications using Express and EJS, this can potentially allow remote code execution. ### Patches The original patched version for mongoose 5.3.3 did not include a fix for CVE-2023-3696. Therefore the existing version @seal-security/mongoose-fixed version 5.3.3 is affected by this vulnerability (though it is protected from CVE-2022-2564 and CVE-2019-17426). To mitigate this issue, a @seal-security/mongoose-fixed version 5.3.4 has been deployed. Note that this version is compatible with the original mongoose version 5.3.3, not version 5.3.4 ### References https://security.snyk.io/vuln/SNYK-JS-MONGOOSE-5777721 https://github.com/advisories/GHSA-9m93-w8w6-76hh https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2

    References: https://github.com/ali-security/mongoose/security/advisories/GHSA-rc4v-99cr-pjcm, https://github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2, https://github.com/ali-security/mongoose, https://security.snyk.io/vuln/SNYK-JS-MONGOOSE-5777721

    Affected packages

    Package

    Name: @seal-security/mongoose-fixed

    Purl: pkg:npm/%40seal-security/mongoose-fixed

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 5.3.3
    Fixed -5.3.4

    Affected versions

    5.3.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-rc4v-99cr-pjcm | CVE-DB