ByteOS Network

CVE Vulnerability Details :

CVE-2020-28472

PUBLISHED

More Info Official Page

Assigner-snyk

Assigner Org ID-bae035ff-b466-4ff4-94d0-fc9efd9e1730

Published At-19 Jan, 2021 | 10:25

Updated At-16 Sep, 2024 | 23:06

▼CVE Numbering Authority (CNA)

Prototype Pollution

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected Products

Vendor

n/a

Product

@aws-sdk/shared-ini-file-loader

Versions

Affected

From unspecified before 1.0.0-rc.9 (custom)

Vendor

n/a

Product

aws-sdk

Versions

Affected

From unspecified before 2.814.0 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Prototype Pollution

Metrics

Version	Base score	Base severity	Vector
3.1	7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Credits

Eugene Lim

Government Technology Agency Cyber Security Group

References

Hyperlink	Resource
https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304	x_refsource_MISC
https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424	x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425	x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426	x_refsource_MISC
https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9	x_refsource_MISC
https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304	x_refsource_MISC x_transferred
https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424	x_refsource_MISC x_transferred
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425	x_refsource_MISC x_transferred
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426	x_refsource_MISC x_transferred
https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9	x_refsource_MISC x_transferred
https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611	x_refsource_MISC x_transferred

Affected Products

Affected

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References