GHSA-xg47-r67p-vhv5

    Dashboard / Vulnerabilities / GHSA-xg47-r67p-vhv5

    GHSA-xg47-r67p-vhv5

    Published: 14 May 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2018-3749

    Summary: Improper Input Validation in Deap

    Details: The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-3749, https://github.com/selfcontained/deap/commit/ed27b7e890bdd616e1ee931ea1c64228e2b52a71, https://hackerone.com/reports/310446, https://github.com/selfcontained/deap

    Affected packages

    Package

    Name: deap

    Purl: pkg:npm/deap

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.0.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High