CVE-2023-45282 Prototype Pollution in NASA Open MCT
Prototype pollution in NASA Open MCT allows attackers to execute arbitrary code via a malicious import action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-45282?
CVE-2023-45282 is a high-severity code injection vulnerability in n/a, published on 6 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.
Weakness: CWE-1321
Which versions are affected by CVE-2023-45282?
2 open source packages ship an affected version, including openmct. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmct npm | All versions to 3.0.2 | None |
openmct npm | All versions to 3.0.2 | None |
Products include Nasa Openmct.
How do I fix CVE-2023-45282?
No fix has been published for CVE-2023-45282 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-45282 being exploited?
There is no known exploitation of CVE-2023-45282 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-45884 NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability
- CVE-2022-22126 Openmct XSS via the “Web Page” element
- CVE-2022-23053 Openmct XSS via the “Condition Widget”
- CVE-2022-23054 Openmct XSS via the “Summary Widget”
- CVE-2023-45885 NASA Open MCT Cross Site Scripting vulnerability
Sources
Also known as GHSA-4xcx-cwrq-w792.