Quick answers
- Is CVE-2020-5258 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-5258 being exploited in the wild.
- How severe is CVE-2020-5258?
- Low severity, with a CVSS score of 3.1, published 10 March 2020.
- Which products and versions are affected?
- dojo (npm) SEMVER:introduced=0,fixed=1.11.10.
- Is there a fix for CVE-2020-5258?
- Yes. dojo (npm): upgrade to 1.11.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-5258 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-5258?
- Check whether you run dojo (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- dojo (npm): upgrade to 1.11.10 or later
npm install dojo@1.11.10
Technical details
The vulnerability is a prototype pollution flaw in the dojo/request/util/deepCopy and dojo/mixin modules. The deepCopy method fails to properly sanitize property names during deep object copying, allowing attackers to inject properties into Object.prototype via special keys like __proto__. An attacker can craft a malicious JSON payload that, when passed to deepCopy, pollutes the base object prototype. This requires the attacker to control input passed to the deepCopy function. The vulnerability has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2.
Affected products
- Dojo dojo <1.11.10, 1.12.0-1.12.7, 1.13.0-1.13.6, 1.14.0-1.14.5, 1.15.0-1.15.2, 1.16.0-1.16.1
Identifiers
- CVE-2020-5258
- GHSA-jxfh-8wgv-vfr2
Timeline
- 2020-03-10: disclosed: Advisory published
- 2020-03-10: patched: Patches released in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3, and 1.16.2