CVE-2020-28441

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea	Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973	Exploit Third Party Advisory
https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea	Patch Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:conf-cfg-ini_project:conf-cfg-ini:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 7.3
References	~~() https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea - Patch, Third Party Advisory~~	() https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea - Patch, Third Party Advisory
References	~~() https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973 - Exploit, Third Party Advisory~~	() https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973 - Exploit, Third Party Advisory

Information

Published : 2022-07-25 14:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28441

Mitre link : CVE-2020-28441

CVE.ORG link : CVE-2020-28441

JSON object : View

Products Affected

conf-cfg-ini_project

conf-cfg-ini

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2020-28441", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-07-25T14:15:09.270", "references": [{"url": "https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context."}, {"lang": "es", "value": "Esto afecta al paquete conf-cfg-ini versiones anteriores a 1.2.2. Si un atacante env\u00eda un archivo INI malicioso a una aplicaci\u00f3n que lo analiza con decodificaci\u00f3n, contaminar\u00e1 el prototipo en la aplicaci\u00f3n. Esto puede ser explotado a\u00fan m\u00e1s dependiendo del contexto"}], "lastModified": "2024-11-21T05:22:48.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:conf-cfg-ini_project:conf-cfg-ini:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "730DBCED-795E-4FC9-9F90-3CDC41DAC7DA", "versionEndExcluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}