lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID)     vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify     the prototype of Object via __proto__, causing the addition or modification of an existing property that     will exist on all objects. (CVE-2018-3721)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID)
    vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify
    the prototype of "Object" via __proto__, causing the addition or modification of an existing property that
    will exist on all objects. (CVE-2018-3721)

According to its self-reported version number, Lodash is prior to 4.17.5. It is, therefore, affected by a prototype pollution vulnerability in the functions merge, mergeWith and defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
251983	Linux Distros Unpatched Vulnerability : CVE-2018-3721	Nessus	Misc.	medium
421935	SCA: security update for lodash, lodash-rails (GHSA-fvqr-27wr-82fm)	Tenable Cloud Security	SCA Checks	medium
421935	SCA: security update for lodash, lodash-rails (GHSA-fvqr-27wr-82fm)	Tenable Self-Hosted Container Security	SCA Checks	medium
113451	Lodash < 4.17.5 Prototype Pollution	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2018-3721

medium

Tenable Plugins

medium

medium

medium

medium