{"id":"CVE-2020-28477","published":"2021-01-19T10:20:13Z","modified":"2024-09-17T04:25:21Z","title":"Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects all versions of package immer.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02341,"percentile":0.83579,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-IMMER-1019369","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986","tags":["x_refsource_MISC"]},{"url":"https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213","tags":["x_refsource_MISC"]}],"priority":{"score":22.0,"factors":[{"name":"EPSS percentile","points":16.72},{"name":"CVSS severity","points":5.25}]},"affectedVersions":[{"vendor":"n/a","product":"immer","versions":["< unspecified"]}],"affected":[{"ecosystem":"npm","package":"immer","vulnerableRanges":[">=7.0.0, <8.0.1"],"patched":["8.0.1"],"from":["GHSA-9qmh-276g-x5pj"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0500","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-immerjs-immer-cve-2020-28477","children":[{"from":"CVE-2020-28477","to":"CVE-2021-23436","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays.","from":"CVE.org","in":"CVE-2021-23436"},{"kind":"same-code","provenance":"machine","files":["src/plugins/patches.ts"],"commits":["https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5","https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237"],"basis":"shared function","functions":["enablePatches"]}]},{"from":"CVE-2020-28477","to":"CVE-2021-3757","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/plugins/patches.ts"],"commits":["https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5","https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237"],"basis":"shared function","functions":["enablePatches"]},{"kind":"similar","provenance":"machine","score":0.54,"basis":"same package + description similarity"}]}]}}