CVE-2019-10808 Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify
Attackers can modify Object.prototype properties via the merge method, potentially leading to code execution or privilege escalation in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10808?
CVE-2019-10808 is a high-severity code injection vulnerability in utilitify, published on 11 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Weakness: CWE-1321
Which versions are affected by CVE-2019-10808?
2 open source packages ship an affected version, including utilitify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
utilitify npm | All versions | 1.0.3 |
utilitify npm | All versions | 1.0.3 |
Products include Xcritical.software Utilitify.
How do I fix CVE-2019-10808?
Upgrade utilitify to 1.0.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-10808 being exploited?
There is no known exploitation of CVE-2019-10808 in the wild and no public exploit code.
Sources
Also known as GHSA-9534-h433-2rjf.