VDB
CVE-2018-3750
CVE-2018-3750
PUBLISHED
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
EPSS 0.29% · 53.0th percentile
Risk Scores
EPSS Score
0.29%
53.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | node-deep-extend | 0, 0.4.1-1 |
Exploit Intelligence
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
- ossf-cve-benchmark/CVE-2018-3750 (github-poc-repo)
…and 24 more exploits
Timeline
- CVE Published
- Apr 15, 2018 PoC Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-3750 third-party-advisory
- https://nodesecurity.io/advisories/612 third-party-advisory
- https://github.com/unclechu/node-deep-extend/issues/39 third-party-advisory
- https://github.com/unclechu/node-deep-extend/pull/40 third-party-advisory
- https://hackerone.com/reports/311333 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-3750 third-party-advisory