Bug 2211614 (CVE-2019-10806) - CVE-2019-10806 vega-util: Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util
Summary: CVE-2019-10806 vega-util: Improperly Controlled Modification of Dynamically-D...
Keywords:
Status: NEW
Alias: CVE-2019-10806
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2211615
TreeView+ depends on / blocked
 
Reported: 2023-06-01 08:45 UTC by Avinash Hanwate
Modified: 2023-07-07 08:29 UTC (History)
2 users (show)

Fixed In Version: vega-util 1.13.1
Doc Type: ---
Doc Text:
A flaw was found in vega-util prototype which could allow a remote authenticated attacker to bypass security restrictions caused by improper access control. By sending a specially crafted request using the vega.mergeConfig method, an attacker could add or modify the properties of the Object.prototype.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2023-06-01 08:45:42 UTC 
vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

References:
https://snyk.io/vuln/SNYK-JS-VEGAUTIL-559223
https://github.com/advisories/GHSA-6hwh-rqwf-cxxr
Note You need to log in before you can comment on or make changes to this bug.