CVE-2023-26113

Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324	Broken Link
https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2	Patch
https://github.com/kobezzza/Collection/issues/27	Exploit Issue Tracking Patch Third Party Advisory
https://github.com/kobezzza/Collection/releases/tag/v6.8.1	Patch Release Notes
https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148	Exploit Technical Description Third Party Advisory
https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324	Broken Link
https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2	Patch
https://github.com/kobezzza/Collection/issues/27	Exploit Issue Tracking Patch Third Party Advisory
https://github.com/kobezzza/Collection/releases/tag/v6.8.1	Patch Release Notes
https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:collection.js_project:collection.js:*:*:*:*:*:node.js:*:*

History

21 Nov 2024, 07:50

Type	Values Removed	Values Added
References	~~() https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 - Broken Link~~	() https://github.com/kobezzza/Collection/blob/be32c48e68f49d3be48a58e929d1ab8ff1d2d19c/dist/node/iterators/extend.js%23L324 - Broken Link
References	~~() https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 - Patch~~	() https://github.com/kobezzza/Collection/commit/d3d937645f62f37d3115d6aa90bb510fd856e6a2 - Patch
References	~~() https://github.com/kobezzza/Collection/issues/27 - Exploit, Issue Tracking, Patch, Third Party Advisory~~	() https://github.com/kobezzza/Collection/issues/27 - Exploit, Issue Tracking, Patch, Third Party Advisory
References	~~() https://github.com/kobezzza/Collection/releases/tag/v6.8.1 - Patch, Release Notes~~	() https://github.com/kobezzza/Collection/releases/tag/v6.8.1 - Patch, Release Notes
References	~~() https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 - Exploit, Technical Description, Third Party Advisory~~	() https://security.snyk.io/vuln/SNYK-JS-COLLECTIONJS-3185148 - Exploit, Technical Description, Third Party Advisory

07 Nov 2023, 04:09

Type	Values Removed	Values Added
Summary	~~Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.~~	Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

Information

Published : 2023-03-18 05:15

Updated : 2024-11-21 07:50

NVD link : CVE-2023-26113

Mitre link : CVE-2023-26113

CVE.ORG link : CVE-2023-26113

JSON object : View

Products Affected

collection.js_project

collection.js

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

7.5 /10