Medium severity · published Mar 12, 2020
CVE-2020-7600
querymen prior to 2.1.4 allows modification of object properties
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Querymen · Querymen Project
before 2.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7600
Exploit
https://github.com/diegohaz/querymen/commit/1987fefcb3b7508253a29502a008d5063a873cef
Patch
https://snyk.io/vuln/SNYK-JS-QUERYMEN-559867
More from Querymen
7.5
CVE-2022-25871
All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any…