A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the     function unflatten of the file index.js. The manipulation leads to improperly controlled modification of     object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely.
    Upgrading to version 5.0.1 is able to address this issue. The name of the patch is     20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The     identifier VDB-216777 was assigned to this vulnerability. (CVE-2020-36632)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the
    function unflatten of the file index.js. The manipulation leads to improperly controlled modification of
    object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely.
    Upgrading to version 5.0.1 is able to address this issue. The name of the patch is
    20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The
    identifier VDB-216777 was assigned to this vulnerability. (CVE-2020-36632)

ID	Name	Product	Family	Severity
262774	Linux Distros Unpatched Vulnerability : CVE-2020-36632	Nessus	Misc.	critical
408951	SCA: security update for flat (GHSA-2j2x-2gpw-g8fm)	Tenable Cloud Security	SCA Checks	critical
408951	SCA: security update for flat (GHSA-2j2x-2gpw-g8fm)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2020-36632

critical

Tenable Plugins

critical

critical

critical