CVE-2020-15366

MEDIUM5.6EPSS 0.33%

Prototype Pollution in Ajv

Published: 2/10/2022Modified: 6/21/2024

Also known as:GHSA-v88g-cgmw-v5xwDEBIAN-CVE-2020-15366

Description

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Affected packages (2)

Debian/node-ajvfrom 0, < 6.12.4-1
npm/ajvfrom 0, < 6.12.3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-15366
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-15366
PATCHhttps://github.com/ajv-validator/ajv
WEBhttps://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f
WEBhttps://github.com/ajv-validator/ajv/releases/tag/v6.12.3
WEBhttps://github.com/ajv-validator/ajv/tags
WEBhttps://hackerone.com/bugs?subject=user&report_id=894259
WEBhttps://security.netapp.com/advisory/ntap-20240621-0007