CVE-2020-8158 TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution in TypeORM allows attackers to modify object properties, potentially leading to denial of service or SQL injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8158?
CVE-2020-8158 is a critical vulnerability in typeorm, published on 18 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Which versions are affected by CVE-2020-8158?
2 open source packages ship an affected version, including typeorm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
typeorm npm | All versions | 0.2.25 |
typeorm npm | All versions | 0.2.25 |
Products include Typeorm Typeorm.
How do I fix CVE-2020-8158?
Upgrade typeorm to 0.2.25 or later.
Is CVE-2020-8158 being exploited?
There is no known exploitation of CVE-2020-8158 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in typeorm
Sources
Also known as GHSA-pf2j-9qmp-jqr2.