VDB
CVE-2020-5259
CVE-2020-5259
PUBLISHED
CVSS 8.600000381469727 HIGH
In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
EPSS 2.02% · 80.6th percentile
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS Score
2.02%
80.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | dojo | 1.11.0+dfsg-1, 0 |
| Ubuntu:Pro:20.04:LTS | dojo | 1.15.0+dfsg1-1, 1.15.0+dfsg1-1ubuntu0.1~esm1, 0 |
| Ubuntu:Pro:16.04:LTS | dojo | *, 1.10.4+dfsg-2, 0 |
Timeline
- Apr 30, 2017 PoC Published
- Mar 10, 2020 CVE Published
- Mar 11, 2020 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Jun 28, 2021 PoC Published
- Aug 25, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- Apr 22, 2022 PoC Published