CVE-2019-10744 Prototype Pollution in lodash

What is CVE-2019-10744?

CVE-2019-10744 is a critical vulnerability in F5 Big-Ip Access Policy Manager, published on 25 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Weakness: CWE-1321

Which versions are affected by CVE-2019-10744?

10 open source packages ship an affected version, including lodash-rails, lodash and lodash-amd. It affects 21 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Application Visibility and Reporting and 15 more.

How do I fix CVE-2019-10744?

Upgrade lodash-rails to 4.17.12 or later.

Is CVE-2019-10744 being exploited?

There is no known exploitation of CVE-2019-10744 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in F5 Big-Ip Access Policy Manager

• CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass Exploited Critical 9.8
• CVE-2022-1388 F5 BIG-IP Missing Authentication Exploited Critical 9.8
• CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Exploited Critical 9.8
• CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer Overflow Exploited Critical 9.8
• CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Exploited Critical 9.8

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-44634, DEBIAN-CVE-2019-10744, GHSA-jf85-cpcp-j695, MINI-4jp3-85gc-3wgg, MINI-5xv2-6g9x-pw54, MINI-m42f-gh7w-8xj7 and 2 more.