CVE-2019-10745 (High) detected in assign-deep-0.4.7.tgz - autoclosed

[mend-for-github-com[bot]]

CVE-2019-10745 - High Severity Vulnerability

Vulnerable Library - assign-deep-0.4.7.tgz

Deeply assign the enumerable properties and/or es6 Symbol properies of source objects to the target (first) object.

Library home page: https://registry.npmjs.org/assign-deep/-/assign-deep-0.4.7.tgz

Path to dependency file: cset/CSETWebNg/package.json

Path to vulnerable library: cset/CSETWebNg/node_modules/assign-deep/package.json

Dependency Hierarchy: - update-0.7.4.tgz (Root Library) - assemble-core-0.25.0.tgz - templates-0.24.3.tgz - engine-base-0.1.3.tgz - engine-0.1.12.tgz - :x: **assign-deep-0.4.7.tgz** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.

Publish Date: 2019-08-20

URL: CVE-2019-10745

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10745

Release Date: 2019-08-20

Fix Resolution: assign-deep - 1.0.1

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.