Is CVE-2020-7709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-7709 being exploited in the wild.

How severe is CVE-2020-7709?

Low severity, with a CVSS score of 3.1, published 10 May 2021.

Which products and versions are affected?

json-pointer json-pointer before 0.6.1.

Is there a fix for CVE-2020-7709?

A patch was published on 2020-09-24: Fix merged in PR #34; version 0.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-7709 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-7709?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-7709: json-pointer prototype pollution

CVE-2020-7709 · Severity: low · CVSS 3.1 · Published 2021-05-10

json-pointer is a JavaScript library used to access and manipulate JSON objects via pointer references. A prototype pollution vulnerability allows an attacker to inject malicious properties into JavaScript objects, potentially leading to unexpected application behavior, data manipulation, or denial of service depending on how the affected application uses the library.

Quick answers

Is CVE-2020-7709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-7709 being exploited in the wild.
How severe is CVE-2020-7709?: Low severity, with a CVSS score of 3.1, published 10 May 2021.
Which products and versions are affected?: json-pointer json-pointer before 0.6.1.
Is there a fix for CVE-2020-7709?: A patch was published on 2020-09-24: Fix merged in PR #34; version 0.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-7709 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-7709?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) affecting json-pointer versions before 0.6.1. The library fails to properly filter dangerous properties such as "prototype", "proto", and "constructor" when processing multiple slash-separated object references. An attacker can craft malicious JSON pointer references that pollute the prototype chain of JavaScript objects. This is a network-accessible vulnerability requiring no user authentication or interaction. Successful exploitation can result in confidentiality loss, integrity compromise, and availability impact. The fix was merged in pull request #34 and released in version 0.6.1.

Affected products

json-pointer json-pointer before 0.6.1

Identifiers

CVE-2020-7709
GHSA-7mg4-w3w5-x5pc

Timeline

2020-10-05: disclosed: Published on NVD
2020-09-24: patched: Fix merged in PR #34; version 0.6.1 released
2021-05-10: advisory: GHSA advisory published

References

https://github.com/manuelstofer/json-pointer/pull/34

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.