ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-0842

PoC —
CVSS 3.1
5.3 medium
EPSS
1%p71
Published
()
Modified
Description

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

Vendors
xml2js project
Products
xml2js
Weakness
CWE-1321
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news

No ingested article mentions this CVE yet.