7.4High
CVE-2020-8203
Description
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| lodash | lodash | < 4.17.20 | |
| oracle | banking corporate lending process management | 14.2.0 | |
| oracle | banking credit facilities process management | 14.2.0 | |
| oracle | banking extensibility workbench | 14.2.0 | |
| oracle | banking liquidity management | 14.2.0 | |
| oracle | banking supply chain finance | 14.2.0 | |
| oracle | banking trade finance process management | 14.2.0 | |
| oracle | banking virtual account management | 14.2.0 | |
| oracle | blockchain platform | < 21.1.2 | |
| oracle | communications billing and revenue management | 7.5.0.23.0 | |
| oracle | communications cloud native core policy | 1.11.0 | |
| oracle | communications session border controller | 8.4 | |
| oracle | communications session router | cz8.4 | |
| oracle | communications subscriber-aware load balancer | cz8.3 | |
| oracle | enterprise communications broker | 3.2.0 | |
| oracle | jd edwards enterpriseone tools | ≤ 9.2.6.0 | |
| oracle | peoplesoft enterprise peopletools | 8.58 | |
| oracle | primavera gateway | 17.12.0 – ≤ 17.12.11 | |
| — | lodash | Not Fixed |
References and patches
- https://hackerone.com/reports/712065 ExploitThird Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20200724-0006/ Third Party Advisory
- https://github.com/lodash/lodash/issues/4874 Issue TrackingVendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
CPE matches (NVD) (42)
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*< 4.17.20cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_liquidity_management:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_liquidity_management:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*< 21.1.2cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*≤ 9.2.6.0cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 17.12.0 ≤ 17.12.11cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 18.8.0 ≤ 18.8.12cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 19.12.0 ≤ 19.12.11cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*≥ 20.12.0 ≤ 20.12.7