Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.0341
Percentile: 0.86938

CVSS Scoring

Mapped CWE(s)

• CWE-1321 : Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1574.010 : Services File Permissions Weakness
  Kill Chain: persistence
• T1574.010 : Services File Permissions Weakness
  Kill Chain: persistence

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*
• cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
• cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
• cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
• cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
• cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:*

← Back to Home