The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
Vulnerable Package issue exists @ Npm-lodash-4.17.11 in branch master
A Prototype Pollution vulnerability was discovered in lodash before 4.17.12, in lodash.defaultsdeep before 4.6.1 and in @sailshq/lodash before 3.10.4. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Vulnerable Package issue exists @ Npm-lodash-4.17.11 in branch master
A Prototype Pollution vulnerability was discovered in lodash before 4.17.12, in lodash.defaultsdeep before 4.6.1 and in @sailshq/lodash before 3.10.4. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Namespace: RobertMickleCx Repository: NodeGoat Repository Url: https://github.com/RobertMickleCx/NodeGoat CxAST-Project: RobertMickleCx/NodeGoat CxAST platform scan: e7941f4d-fb14-4e6e-9cdc-c12dbbe3cdc7 Branch: master Application: NodeGoat Severity: HIGH State: NOT_IGNORED Status: RECURRENT CWE: CWE-1321
Additional Info Attack vector: NETWORK Attack complexity: LOW Confidentiality impact: HIGH Availability impact: HIGH
References Disclosure Advisory Pull request Commit Commit Advisory Advisory