CVE-2023-26158

CVSS 3.1 Score 8.2 of 10 (high)

Details

Published Dec 8, 2023
Updated: Dec 12, 2023
CWE ID 1321

Summary

CVE-2023-26158 is a vulnerability found in all versions of the package mockjs. It is categorized as a high-risk vulnerability with a base severity score of 8.2. This vulnerability is related to prototype pollution, specifically through the Util.extend function, which does not check if the attribute resolves to the object prototype. An attacker could exploit this vulnerability by injecting user-controlled inputs into the extend() method of certain components. The affected products include various versions of tyFUC and tyFUDA. To remediate this vulnerability, a workaround is suggested by adding a denylist of dangerous attributes in the Util.extend function. This vulnerability poses a potential danger to organizations if their software relies on specific attributes or uses predefined attributes of the object prototype, as it could lead to attribute manipulation or replacement with malicious ones.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-26158 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options