RCE in Dojo
CVE-2020-5258
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.040 (89.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Dojo — versions < 1.12.8, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.6
- Linuxfoundation Dojo
- Oracle Communications_application_session_controller — versions 3.9.0
- Oracle Communications_policy_management — versions 12.5.0
- Oracle Communications_pricing_design_center — versions 12.0.0.3.0
- Oracle Documaker
- Oracle Mysql
- Oracle Primavera_unifier — versions 18.8, 19.12, 20.12
- Oracle Webcenter_sites — versions 12.2.1.3.0, 12.2.1.4.0
- Oracle Weblogic_server — versions 12.2.1.4.0, 14.1.1.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (mailing-list, x_refsource_MLIST)
- security-advisories@github.com (mailing-list, x_refsource_MLIST)
- security-advisories@github.com (mailing-list, x_refsource_MLIST)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-5258?
- CVE-2020-5258 is a high-severity vulnerability in Dojo, classified under Code Injection. CVSS score: 7.7/10. Published 2020-03-10.
- How severe is CVE-2020-5258?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2020-5258 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.