RCE in Dojo
CVE-2020-5258
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.040 (90.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.040 · newest: 0.040 · change: 0.000
Affected products
- Dojo — versions < 1.12.8, >= 1.13.0, < 1.13.7, >= 1.14.0, < 1.14.6
- Linuxfoundation Dojo
- Oracle Communications Application Session Controller — versions 3.9.0
- Oracle Communications Policy Management — versions 12.5.0
- Oracle Communications Pricing Design Center — versions 12.0.0.3.0
- Oracle Documaker
- Oracle MySQL
- Oracle Primavera Unifier — versions 18.8, 19.12, 20.12
- Oracle Webcenter Sites — versions 12.2.1.3.0, 12.2.1.4.0
- Oracle Weblogic Server — versions 12.2.1.4.0, 14.1.1.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.debian.org/debian-lts-announce/2020/03/msg00012.html (mailing-list, Mailing List, Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2 (Exploit, Third Party Advisory)
- github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d (Patch, Third Party Advisory)
- lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a80… (mailing-list)
- lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78e… (mailing-list)
- lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6d… (mailing-list)
- www.oracle.com//security-alerts/cpujul2021.html (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpuoct2021.html (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpujan2022.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-5258?
- CVE-2020-5258 is a high-severity vulnerability in Dojo, classified under Code Injection. CVSS score: 7.7/10. Published 2020-03-10.
- How severe is CVE-2020-5258?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2020-5258 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.