CVE-2020-28495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-28495
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-28495.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-28495
Aliases
Related
  • SNYK-JS-TOTALJS-1046671
Published
2021-02-02T11:15:13.257Z
Modified
2026-03-15T14:42:10.830813Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.

References

Affected packages

Git / github.com/totaljs/framework

Affected ranges

Type
GIT
Repo
https://github.com/totaljs/framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b3f901561d66ab799a4a99279893b94cad7ae4ff
Type
GIT
Repo
https://github.com/totaljs/framework
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b3f901561d66ab799a4a99279893b94cad7ae4ff

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.2.3
v1.2.3-1
v1.2.4
v1.3.0
v1.3.1
v1.4.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.6.3
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "3.4.7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "total.js"
            },
            {
                "fixed": "3.4.7"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-28495.json"