CVE-2020-28472: Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28472?
The severity of CVE-2020-28472 is classified as high due to its potential to lead to prototype pollution in affected applications.
How do I fix CVE-2020-28472?
To fix CVE-2020-28472, upgrade the @aws-sdk/shared-ini-file-loader package to version 1.0.0-rc.9 or later and the aws-sdk package to version 2.814.0 or later.
Which versions are affected by CVE-2020-28472?
CVE-2020-28472 affects versions of the @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9 and aws-sdk before 2.814.0.
What impact does CVE-2020-28472 have on applications?
CVE-2020-28472 can allow an attacker to submit a malicious INI file that may lead to prototype pollution, compromising application integrity.
Are there any known exploits for CVE-2020-28472?
While specific exploits for CVE-2020-28472 have not been publicly disclosed, the vulnerability's nature poses a significant risk if left unaddressed.