Prototype Pollution in Mozilla Convict
CVE-2023-0163
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still, a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. This issue affects Convict: before 6.2.4.
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (17.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 17.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Mozilla Convict — versions 0
Weakness classification (CWE)
References
- github.com/mozilla/node-convict/issues/410 (issue-tracking, Exploit, Issue Tracking)
- github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-0163?
- CVE-2023-0163 is a high-severity vulnerability in Mozilla Convict, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 8.4/10. Published 2024-11-26.
- How severe is CVE-2023-0163?
- High severity. CVSS v3 base score is 8.4 out of 10.