alexbinary object-deep-assign 1.0.11 /src/index.js extend prototype pollution

Summaryinfo

A vulnerability described as problematic has been identified in alexbinary object-deep-assign 1.0.11. Impacted is the function extend of the file /src/index.js. The manipulation results in prototype pollution. This vulnerability is reported as CVE-2024-36582. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in alexbinary object-deep-assign 1.0.11. Affected is the function extend of the file /src/index.js. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on integrity. CVE summarizes:

alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)

The advisory is shared for download at gist.github.com. This vulnerability is traded as CVE-2024-36582 since 05/30/2024. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• alexbinary

Name

• object-deep-assign

Version

• 1.0.11

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion