CVE-2020-8203

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Link	Resource
https://hackerone.com/reports/712065	Exploit Third Party Advisory
https://security.netapp.com/advisory/ntap-20200724-0006/	Third Party Advisory
https://github.com/lodash/lodash/issues/4874	Issue Tracking Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_liquidity_management:14.5.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:banking_liquidity_management:14.3.0:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*

---

Published : 2020-07-15 05:15

Updated : 2022-05-12 03:01

---

NVD link : CVE-2020-8203

Mitre link : CVE-2020-8203

No products.

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')