CVE-2020-7743

EUVD-2021-1224 · Published May 10, 2021

Prototype Pollution in mathjs The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

Technologies

Mathjs Mathjs

Weaknesses

CWE-1321CWE-915

CVSS scores

v3.17.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth

T1190Exploit Public-Facing Application T1574.010Services File Permissions Weakness

References

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1017113
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1017112
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1017111
https://snyk.io/vuln/SNYK-JS-MATHJS-1016401
https://github.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82
https://github.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e

Potentially impacted assets

See if this affects your attack surface