Is CVE-2018-3719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3719 being exploited in the wild.

How severe is CVE-2018-3719?

Low severity, with a CVSS score of 3.1, published 26 July 2018.

Which products and versions are affected?

mixin-deep (npm) SEMVER:introduced=0,fixed=1.3.1.

Is there a fix for CVE-2018-3719?

Yes. mixin-deep (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3719 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-3719?

Check whether you run mixin-deep (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3719: mixin-deep prototype pollution via merging functions

CVE-2018-3719 · Severity: low · CVSS 3.1 · Published 2018-07-26

mixin-deep is a Node.js library used to deeply merge objects. A vulnerability in this library allows an attacker to inject properties into the global Object prototype, which can lead to application crashes, data corruption, or unauthorized access across the entire application. This affects any software relying on this library to process untrusted user input.

Vendors: npm.

Quick answers

Is CVE-2018-3719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3719 being exploited in the wild.
How severe is CVE-2018-3719?: Low severity, with a CVSS score of 3.1, published 26 July 2018.
Which products and versions are affected?: mixin-deep (npm) SEMVER:introduced=0,fixed=1.3.1.
Is there a fix for CVE-2018-3719?: Yes. mixin-deep (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3719 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-3719?: Check whether you run mixin-deep (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mixin-deep (npm): upgrade to 1.3.1 or later
```
npm install mixin-deep@1.3.1
```

Technical details

The mixin-deep package before version 1.3.1 is vulnerable to prototype pollution (CWE-471/CWE-20) via its merging functions. The root cause is a failure to sanitize the '__proto__' property during the recursive merge process. An attacker can provide a specially crafted object containing a '__proto__' key to inject or modify properties on the global Object prototype. This can be exploited over the network if the application merges user-controlled input, potentially leading to remote code execution, denial of service, or bypass of security checks. The issue is fixed in version 1.3.1 by explicitly excluding the '__proto__' key during the copy operation.

Affected products

jonschlinkert mixin-deep < 1.3.1

Identifiers

CVE-2018-3719
GHSA-3mpr-hq3p-49h9

Timeline

2018-06-06: disclosed: NVD Published Date
2018-07-26: advisory: GitHub Advisory published
2018-05-22: patched: Fix commit pushed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.