An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
References
| Link | Resource |
|---|---|
| https://github.com/ajv-validator/ajv/releases/tag/v6.12.3 | Release Notes Third Party Advisory |
| https://github.com/ajv-validator/ajv/tags | Third Party Advisory |
| https://hackerone.com/bugs?subject=user&report_id=894259 | Permissions Required |
| https://security.netapp.com/advisory/ntap-20240621-0007/ | |
| https://github.com/ajv-validator/ajv/releases/tag/v6.12.3 | Release Notes Third Party Advisory |
| https://github.com/ajv-validator/ajv/tags | Third Party Advisory |
| https://hackerone.com/bugs?subject=user&report_id=894259 | Permissions Required |
| https://security.netapp.com/advisory/ntap-20240621-0007/ |
Configurations
History
21 Nov 2024, 05:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ajv-validator/ajv/releases/tag/v6.12.3 - Release Notes, Third Party Advisory | |
| References | () https://github.com/ajv-validator/ajv/tags - Third Party Advisory | |
| References | () https://hackerone.com/bugs?subject=user&report_id=894259 - Permissions Required | |
| References | () https://security.netapp.com/advisory/ntap-20240621-0007/ - |
21 Jun 2024, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2020-07-15 20:15
Updated : 2024-11-21 05:05
NVD link : CVE-2020-15366
Mitre link : CVE-2020-15366
CVE.ORG link : CVE-2020-15366
JSON object : View
Products Affected
ajv.js
- ajv
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')