CVE-2018-3721: Input Validation
First published: Thu Feb 15 2018(Updated: )
Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allows modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property leading to potential denial of service. Upstream patch: <a href="https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a">https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a</a> References: <a href="https://snyk.io/vuln/npm:lodash:20180130">https://snyk.io/vuln/npm:lodash:20180130</a> <a href="https://hackerone.com/reports/310443">https://hackerone.com/reports/310443</a>
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/lodash | <4.17.5 | 4.17.5 |
| npm/lodash | <4.17.5 | 4.17.5 |
| Lodash Lodash Node.js | <4.17.5 | |
| Netapp Active Iq Unified Manager Linux | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| Netapp System Manager | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2018-3721 https://nvd.nist.gov/vuln/detail/CVE-2018-3721
- https://bugzilla.redhat.com/show_bug.cgi?id=1545884
- https://access.redhat.com/errata/RHSA-2021:3917
- https://access.redhat.com/security/cve/cve-2018-3721
- https://exchange.xforce.ibmcloud.com/vulnerabilities/144603
- https://www.ibm.com/support/pages/node/6214472 (Advisory)
- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
- https://hackerone.com/reports/310443
- https://security.netapp.com/advisory/ntap-20190919-0004/
- https://snyk.io/vuln/npm:lodash:20180130
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1545887
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1545885
- https://github.com/sendgrid/sendgrid-nodejs/blob/967fb3105908617b41b761d3f18bbc623eb4579a/lib/sendgrid.js#L70
- https://nvd.nist.gov/vuln/detail/CVE-2018-3721
- https://github.com/advisories/GHSA-fvqr-27wr-82fm (Advisory)
- https://www.npmjs.com/advisories/577
- https://security.netapp.com/advisory/ntap-20190919-0004
Frequently Asked Questions
What is the vulnerability ID for this Node.js lodash vulnerability?
The vulnerability ID for this Node.js lodash vulnerability is CVE-2018-3721.
What is the severity level of CVE-2018-3721?
The severity level of CVE-2018-3721 is medium (5.3).
How does the vulnerability in Node.js lodash module manifest?
The vulnerability in Node.js lodash module allows a remote attacker to bypass security restrictions by modifying the prototype of 'Object' via '__proto__', causing the addition or modification of an existing property.
What is the affected software for CVE-2018-3721?
The affected software for CVE-2018-3721 includes the lodash node module before version 4.17.5 and IBM Security Verify Governance before version 10.0.
How can I fix the vulnerability in Node.js lodash module?
To fix the vulnerability in Node.js lodash module, update the lodash package to version 4.17.5 or higher.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-3721
- agent/software-canonical-lookup
- agent/remedy
- agent/weakness
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fvqr-27wr-82fm
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- collector/github-advisory
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- package-manager/npm
- vendor/lodash
- canonical/lodash lodash node.js
- vendor/netapp
- canonical/netapp active iq unified manager linux
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp system manager
- version/netapp system manager/9.0