CVE-2020-7600 Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen
Prototype pollution in querymen allows attackers to modify object properties, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7600?
CVE-2020-7600 is a medium-severity vulnerability in querymen, published on 12 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7600?
2 open source packages ship an affected version, including querymen. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
querymen npm | All versions | 2.1.4 |
querymen npm | All versions | 2.1.4 |
Products include Querymen Project Querymen.
How do I fix CVE-2020-7600?
Upgrade querymen to 2.1.4 or later.
Is CVE-2020-7600 being exploited?
There is no known exploitation of CVE-2020-7600 in the wild and no public exploit code.
Other vulnerabilities in querymen
Sources
Also known as GHSA-2cf2-2383-h4jv, SNYK-JS-QUERYMEN-559867.