Quick answers
- Is CVE-2020-28480 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-28480 being exploited in the wild.
- How severe is CVE-2020-28480?
- Informational severity, with a CVSS score of 7.5, published 20 January 2021.
- Which products and versions are affected?
- jointjs (npm) SEMVER:introduced=0,fixed=3.3.0.
- Is there a fix for CVE-2020-28480?
- Yes. jointjs (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-28480 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-28480?
- Check whether you run jointjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- jointjs (npm): upgrade to 3.3.0 or later
npm install jointjs@3.3.0
Technical details
The vulnerability is a prototype pollution flaw in JointJS's util.setByPath function, where the path parameter used to access and set object keys is not properly sanitized. This allows an attacker to inject special keys like __proto__, constructor, or prototype to pollute the JavaScript prototype chain. The attack requires the ability to control input passed to util.setByPath, which may be reachable through application functionality that processes user-supplied data. Successful exploitation can modify global object properties, affecting all instances of affected objects and potentially causing denial of service or enabling further attacks. The vulnerability was fixed in version 3.3.0.
Affected products
- JointJS JointJS before 3.3.0
Identifiers
- CVE-2020-28480
- GHSA-qwp9-52h8-xgg8
Timeline
- 2021-01-20: disclosed: Advisory published (GHSA-qwp9-52h8-xgg8)
- 3.3.0: patched: Fix released in version 3.3.0