CVE-2018-16472

A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.

Published: Nov 6, 2018
Updated: May 9, 2024
CVE: CVE-2018-16472
GHSA: GHSA-hc9w-4p87-j549
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-20
CWE-400

Affected Software
References

Software	From	Fixed in
cached-path-relative_project / cached-path-relative	-	1.0.1.x
debian / debian_linux	10.0	10.0.x
cached-path-relative	-	1.0.2

https://github.com/ashaffer/cached-path-relative/issues/3
https://github.com/nodejs/security-wg/blob/master/vuln/npm/480.json
https://hackerone.com/reports/390847
https://lists.debian.org/debian-lts-announce/2022/12/msg00006.html
https://www.npmjs.com/advisories/739

Vulnerability Database

CVE-2018-16472