CVE-2020-7774
Prototype Pollution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
El paquete y18n anterior a las versiones 3.2.2, 4.0.1 y 5.0.5, es vulnerable a la contaminación de prototipos
A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality.
Red Hat OpenShift Container Storage is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Container Storage is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass and denial of service vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-21 CVE Reserved
- 2020-11-17 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (8)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/yargs/y18n/issues/96 | 2024-09-16 | |
| https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306 | 2024-09-16 | |
| https://snyk.io/vuln/SNYK-JS-Y18N-1021887 | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | 2022-12-02 | |
| https://github.com/yargs/y18n/pull/108 | 2022-12-02 | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | 2022-12-02 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-7774 | 2021-07-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1898680 | 2021-07-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Y18n Project Search vendor "Y18n Project" | Y18n Search vendor "Y18n Project" for product "Y18n" | < 3.2.2 Search vendor "Y18n Project" for product "Y18n" and version " < 3.2.2" | node.js |
Affected
| ||||||
| Y18n Project Search vendor "Y18n Project" | Y18n Search vendor "Y18n Project" for product "Y18n" | >= 5.0.0 < 5.0.5 Search vendor "Y18n Project" for product "Y18n" and version " >= 5.0.0 < 5.0.5" | node.js |
Affected
| ||||||
| Y18n Project Search vendor "Y18n Project" | Y18n Search vendor "Y18n Project" for product "Y18n" | 4.0.0 Search vendor "Y18n Project" for product "Y18n" and version "4.0.0" | node.js |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 19.3.5 Search vendor "Oracle" for product "Graalvm" and version "19.3.5" | enterprise |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 20.3.1.2 Search vendor "Oracle" for product "Graalvm" and version "20.3.1.2" | enterprise |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 21.0.0.2 Search vendor "Oracle" for product "Graalvm" and version "21.0.0.2" | enterprise |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinec Infrastructure Network Services Search vendor "Siemens" for product "Sinec Infrastructure Network Services" | < 1.0.1.1 Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1" | - |
Affected
| ||||||