"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different
    vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to
    pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation
    can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files
    by using load/loadSync functions, or (3) providing untrusted input to the functions
    ReflectionObject.setParsedOption and util.setProperty. (CVE-2023-36665)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different     vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to     pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation     can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files     by using load/loadSync functions, or (3) providing untrusted input to the functions     ReflectionObject.setParsedOption and util.setProperty. (CVE-2023-36665)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459480	Echo: protobufjs: security update to 6.11.4	Tenable Cloud Security	Echo Local Security Checks	Local	critical
459480	Echo: protobufjs: security update to 6.11.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
225913	Linux Distros Unpatched Vulnerability : CVE-2023-36665	Nessus	Misc.	Local	critical
415554	SCA: security update for protobufjs (GHSA-h755-8qp9-cq85)	Tenable Cloud Security	SCA Checks	Local	critical
415554	SCA: security update for protobufjs (GHSA-h755-8qp9-cq85)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2023-36665

critical

Tenable Plugins

critical

critical

critical

critical

critical