Vulnerability Name:

CVE-2020-7608 (CCN-178132)

Assigned:2020-03-16
Published:2020-03-16
Updated:2022-11-15
Summary:yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
CVSS v3 Severity:5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
4.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
4.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-1321
CWE-267
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2020-7608

Source: XF
Type: UNKNOWN
nodejs-cve20207608-code-exec(178132)

Source: CCN
Type: SNYK-JS-YARGSPARSER-560381
Prototype pollution

Source: MISC
Type: Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

Source: CCN
Type: IBM Security Bulletin 6382126 (Netezza for Cloud Pak for Data)
OSS scan fixes for Content pos

Source: CCN
Type: IBM Security Bulletin 6403463 (Security Guardium Insights)
IBM Security Guardium Insights is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6453115 (Cloud Pak for Security)
Cloud Pak for Security contains security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6491089 (App Connect Enterprise)
Vulnerabilities in Node.js affect IBM App Connect Enterprise v11, v12 (CVE-2020-7608)

Source: CCN
Type: IBM Security Bulletin 6566889 (Spectrum Discover)
Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)

Source: CCN
Type: IBM Security Bulletin 6613009 (Cloud Pak System Software)
Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System

Source: CCN
Type: IBM Security Bulletin 6854981 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Source: CCN
Type: NPM Web site
yargs-parser

Vulnerable Configuration:Configuration 1:
  • cpe:/a:yargs:yargs-parser:*:*:*:*:*:node.js:*:* (Version >= 14.0.0 and < 15.0.1)
  • OR cpe:/a:yargs:yargs-parser:*:*:*:*:*:node.js:*:* (Version >= 16.0.0 and < 18.1.1)
  • OR cpe:/a:yargs:yargs-parser:*:*:*:*:*:node.js:*:* (Version < 5.0.1)
  • OR cpe:/a:yargs:yargs-parser:*:*:*:*:*:node.js:*:* (Version >= 6.0.0 and < 13.1.2)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:*
  • OR cpe:/a:ibm:app_connect:11.0.0.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:ibm:integration_bus:10.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium_insights:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise:12.0.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.6.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20210548
    P
    		RHSA-2021:0548: nodejs:10 security update (Moderate)
    2021-02-16
    oval:com.redhat.rhsa:def:20205499
    P
    		RHSA-2020:5499: nodejs:12 security and bug fix update (Moderate)
    2020-12-15
    BACK
    yargs yargs-parser *
    yargs yargs-parser *
    yargs yargs-parser *
    yargs yargs-parser *
    nodejs node.js *
    ibm app connect 11.0.0.0
    ibm integration bus 10.0.0.0
    ibm security guardium insights 2.0.2
    ibm cloud pak for security 1.4.0.0
    ibm cloud pak for security 1.6.0.0
    ibm cloud pak for security 1.5.0.1
    ibm cloud pak for security 1.5.0.0
    ibm cloud pak for security 1.6.0.1
    ibm app connect enterprise 12.0.1.0
    ibm cloud pak for security 1.10.0.0
    ibm cloud pak for security 1.10.6.0