datatables.net vulnerable to Prototype Pollution due to incomplete fix · CVE-2020-28458 · GitHub Advisory Database · GitHub

datatables.net vulnerable to Prototype Pollution due to incomplete fix

High severity GitHub Reviewed Published Dec 17, 2020 to the GitHub Advisory Database • Updated Jun 21, 2024

Package

datatables.net (npm)

Affected versions

< 1.10.22

Patched versions

1.10.22

Description

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

References

Published by the National Vulnerability Database

Dec 16, 2020

Reviewed Dec 17, 2020

Published to the GitHub Advisory Database Dec 17, 2020

Last updated Jun 21, 2024

Severity

High

7.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L