CVE-2018-16487 Prototype Pollution in lodash
MediumCVSS 5.6
EPSS 1.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm lodash(npm) | < 4.17.11 | 4.17.11 |
| rubygems lodash-rails(RubyGems) | < 4.17.11 | 4.17.11 |
| rubygems lodash-rails(RubyGems) | = 0.10.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.7.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.8.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.8.2 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.9.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.9.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 0.9.2 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.0.0.rc.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.0.0.rc.2 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.0.0.rc.3 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.0.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.1.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.1.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.2.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.2.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 1.3.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.0.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.1.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.2.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.2.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.3.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.4.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 2.4.1 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems lodash-rails(RubyGems) | = 3.1.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.10.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.10.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.2.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.3.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.3.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.3.1.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.4.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.5.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.6.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.7.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 3.9.3 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.0.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.11.2 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.12.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.13.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.14.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.15.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.16.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.16.3 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.16.4 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.16.6 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.17.10 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.17.2 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.17.4 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.17.5 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.3.0 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.5.1 | No fix listed |
| rubygems lodash-rails(RubyGems) | = 4.6.1 | No fix listed |
| debian/node-lodash(Debian:12) | < 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
| debian/node-lodash(Debian:13) | < 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
| debian/node-lodash(Debian:14) | < 4.17.11+dfsg-1 | 4.17.11+dfsg-1 |
| lodash | < 4.17.11 | 4.17.11 |
| HackerOne lodash | = <4.7.11 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- hackerone.com exploit issue-tracking third-party-advisory
- github.com exploit
- security.netapp.com third-party-advisory
- Debian Security Tracker CVE-2018-16487 vendor-advisory
- github.com