CVE Daily

CVE-2020-28460

This affects the package multi-ini before 2.1.2. It is possible to pollute an ob...

Medium CVSS 5.6

Overview

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

CWE: CWE-1321 Published: 2020-12-22T13:15:12.507
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.6 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags