Quick answers
- Is CVE-2020-15256 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-15256 being exploited in the wild.
- How severe is CVE-2020-15256?
- Low severity, with a CVSS score of 3.1, published 19 October 2020.
- Which products and versions are affected?
- object-path (npm) < 0.11.5.
- Is there a fix for CVE-2020-15256?
- A patch was published on 2020-10-19: Version 0.11.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-15256 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-15256?
- Check whether you run object-path (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a prototype pollution flaw in the set() method of object-path versions <= 0.11.4. In versions >= 0.11.0, the vulnerability is limited to use of the includeInheritedProps mode, which must be explicitly enabled; in versions < 0.11.0, all usage of set() is vulnerable. An attacker can craft malicious input to pollute the Object prototype, affecting all objects in the runtime. The attack is network-reachable if the application accepts user-supplied input that flows to object-path's set() method. Patches are available in version 0.11.5 or later.
Affected products
- npm object-path < 0.11.5
Identifiers
- CVE-2020-15256
- GHSA-cwx2-736x-mf6w
Timeline
- 2020-10-19: disclosed
- 2020-10-19: patched: Version 0.11.5 released