Fix CVE–2020–8116

[debricked]

CVE–2020–8116

Vulnerable dependency:     dot-prop (npm)    3.0.0

Vulnerability details

Description

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

GitHub

Prototype Pollution in dot-prop

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

NVD

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

CVSS details - 7.3

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity	Low
Availability	Low

References

    THIRD PARTY
    Prototype Pollution in dot-prop · CVE-2020-8116 · GitHub Advisory Database · GitHub
    HackerOne
    GitHub - sindresorhus/dot-prop at v4
    Please backport CVE-2020-8116 security fix to 4.x. · Issue #63 · sindresorhus/dot-prop · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE