CVE-2018-16489 (High) detected in just-extend-1.1.27.tgz

[mend-bolt-for-github]

CVE-2018-16489 - High Severity Vulnerability

Vulnerable Library - just-extend-1.1.27.tgz

extend an object

Library home page: https://registry.npmjs.org/just-extend/-/just-extend-1.1.27.tgz

Path to dependency file: generator-jhipster/package.json

Path to vulnerable library: generator-jhipster/node_modules/just-extend/package.json

Dependency Hierarchy:

• sinon-6.1.3.tgz (Root Library)
  • nise-1.3.3.tgz
    • ❌ just-extend-1.1.27.tgz (Vulnerable Library)

Found in HEAD commit: d008e0c5a465adb53c02310123b8a0cb2febbdbb

Vulnerability Details

A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

Publish Date: 2019-02-01

URL: CVE-2018-16489

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/430291

Release Date: 2019-02-01

Fix Resolution: 4.0.0