CVE-2019-10768
HIGH7.5EPSS 0.41%angular Prototype Pollution vulnerability
發布日:2019/11/20修改日:2026/4/28
描述
In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
受影響套件(2)
- Debian/angular.jsfrom 0, < 1.7.9-1
- npm/angularfrom 0, < 1.7.9
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
參考連結(8)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-10768
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-10768
- PATCHhttps://github.com/angular/angular.js
- WEBhttps://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3
- WEBhttps://github.com/angular/angular.js/pull/16913
- WEBhttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
- WEBhttps://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
- WEBhttps://snyk.io/vuln/SNYK-JS-ANGULAR-534884