GHSA-92xj-mqp7-vmcj

Source

https://github.com/advisories/GHSA-92xj-mqp7-vmcj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-92xj-mqp7-vmcj/GHSA-92xj-mqp7-vmcj.json

Aliases

• CVE-2020-7720
• SNYK-JAVA-ORGWEBJARSNPM-609293
• SNYK-JS-NODEFORGE-598677

Published

2020-09-14T21:42:09Z

Modified

2023-11-08T04:04:06.783947Z

Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7720
• https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756
• https://github.com/digitalbazaar/forge
• https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md
• https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md#removed
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293
• https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677