CVE-2020-28458 Prototype Pollution
Prototype pollution in datatables.net allows attackers to manipulate object prototypes, potentially leading to code execution or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28458?
CVE-2020-28458 is a high-severity vulnerability in datatables.net, published on 16 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Weakness: CWE-1321
Which versions are affected by CVE-2020-28458?
2 open source packages ship an affected version, including datatables.net. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
datatables.net npm | All versions | 1.10.22 |
datatables.net npm | All versions | 1.10.22 |
Linux distribution packages (2)
cockpit-ovirt Red Hat:rhev_hypervisor:4.4::el8 | All versions | 0:0.14.20-1.el8ev |
cockpit-ovirt-dashboard Red Hat:rhev_hypervisor:4.4::el8 | All versions | 0:0.14.20-1.el8ev |
Products include Datatables Datatables.net.
How do I fix CVE-2020-28458?
Upgrade datatables.net to 1.10.22 or later.
Is CVE-2020-28458 being exploited?
There is no known exploitation of CVE-2020-28458 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in datatables.net
Sources
Also known as AZL-53184, GHSA-m7j4-fhg6-xf5v, RHSA-2021:1184.