CVE-2020-5258
- Source
- https://cve.org/CVERecord?id=CVE-2020-5258
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5258.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-5258
- Aliases
- Downstream
CGA (14)
DEBIAN (1)
MGASA (1)
UBUNTU (1)
- Published
- 2020-03-10T18:15:12Z
- Modified
- 2026-10-22T02:48:07Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.6.0" }, { "last_affected": "12.6.4" } ], "source": "CPE_RANGE" } ], "vendor_product": "oracle:documaker" }, { "cpes": [ "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "7.3.0" }, { "last_affected": "7.3.29" }, { "introduced": "7.4.0" }, { "last_affected": "7.4.28" }, { "introduced": "7.5.0" }, { "last_affected": "7.5.18" }, { "introduced": "7.6.0" }, { "last_affected": "7.6.14" }, { "introduced": "8.0.0" }, { "last_affected": "8.0.20" } ], "source": "CPE_RANGE" } ], "vendor_product": "oracle:mysql" }, { "cpes": [ "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "17.7" }, { "last_affected": "17.12" } ], "source": "CPE_RANGE" } ], "vendor_product": "oracle:primavera_unifier" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "8.0" }, { "last_affected": "8.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "3.9.0" }, { "last_affected": "3.9.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_application_session_controller" }, { "cpes": [ "cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.5.0" }, { "last_affected": "12.5.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_policy_management" }, { "cpes": [ "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.0.0.3.0" }, { "last_affected": "12.0.0.3.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:communications_pricing_design_center" }, { "cpes": [ "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "18.8" }, { "last_affected": "18.8" }, { "introduced": "19.12" }, { "last_affected": "19.12" }, { "introduced": "20.12" }, { "last_affected": "20.12" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:primavera_unifier" }, { "cpes": [ "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:webcenter_sites" }, { "cpes": [ "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" }, { "introduced": "14.1.1.0.0" }, { "last_affected": "14.1.1.0.0" } ], "source": "CPE_STRING" } ], "vendor_product": "oracle:weblogic_server" } ] }- References
-
- https://lists.apache.org/thread.html/r3638722360d7ae95f874280518b8d987d799a76df7a9cd78eac33a1b%40%3Cusers.qpid.apache.org%3E
- https://lists.apache.org/thread.html/r665fcc152bd0fec9f71511a6c2435ff24d3a71386b01b1a6df326fd3%40%3Cusers.qpid.apache.org%3E
- https://lists.apache.org/thread.html/rf481b3f25f05c52ba4e24991a941c1a6e88d281c6c9360a806554d00%40%3Cusers.qpid.apache.org%3E
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://github.com/dojo/dojo/commit/20a00afb68f5587946dc76fbeaa68c39bda2171d
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/dojo/dojo/security/advisories/GHSA-jxfh-8wgv-vfr2
Affected packages
Git / github.com/dojo/dojo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/dojo/dojo
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "0" }, { "fixed": "1.11.10" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "1.12.0" }, { "fixed": "1.12.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "1.13.0" }, { "fixed": "1.13.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "1.14.0" }, { "fixed": "1.14.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "1.15.0" }, { "fixed": "1.15.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:linuxfoundation:dojo:*:*:*:*:*:node.js:*:*", "range": [ { "introduced": "1.16.0" }, { "fixed": "1.16.2" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "20a00afb68f5587946dc76fbeaa68c39bda2171d" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
1.*
1.10.0
1.10.0-beta1
1.10.0-rc1
1.11.0
1.11.0-rc1
1.11.0-rc2
1.11.0-rc3
1.11.0-rc4
1.11.0-rc5
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
1.11.6
1.11.7
1.11.8
1.11.9
1.12.0
1.12.1
1.12.2
1.12.3
1.12.4
1.12.5
1.12.6
1.12.7
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.1
1.14.2
1.14.3
1.14.4
1.14.5
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1