Intel

CVE-2018-16487

lodash: Uncontrolled Resource Consumption (CVE-2018-16487)

mediumEPSS 1.6%

Affected

  • rubygems/lodash-rails 0.10.0..*
  • rubygems/lodash-rails 0.7.0..*
  • rubygems/lodash-rails 0.8.1..*
  • rubygems/lodash-rails 0.8.2..*
  • rubygems/lodash-rails 0.9.0..*
  • rubygems/lodash-rails 0.9.1..*
  • rubygems/lodash-rails 0.9.2..*
  • rubygems/lodash-rails 1.0.0.rc.1..*
  • rubygems/lodash-rails 1.0.0.rc.2..*
  • rubygems/lodash-rails 1.0.0.rc.3..*
  • rubygems/lodash-rails 1.0.1..*
  • rubygems/lodash-rails 1.1.0..*
  • rubygems/lodash-rails 1.1.1..*
  • rubygems/lodash-rails 1.2.0..*
  • rubygems/lodash-rails 1.2.1..*
  • rubygems/lodash-rails 1.3.1..*
  • rubygems/lodash-rails 2.0.0..*
  • rubygems/lodash-rails 2.1.0..*
  • rubygems/lodash-rails 2.2.0..*
  • rubygems/lodash-rails 2.2.1..*
  • rubygems/lodash-rails 2.3.0..*
  • rubygems/lodash-rails 2.4.0..*
  • rubygems/lodash-rails 2.4.1..*
  • rubygems/lodash-rails 3.1.0..*
  • rubygems/lodash-rails 3.10.0..*
  • rubygems/lodash-rails 3.10.1..*
  • rubygems/lodash-rails 3.2.0..*
  • rubygems/lodash-rails 3.3.0..*
  • rubygems/lodash-rails 3.3.1..*
  • rubygems/lodash-rails 3.3.1.1..*
  • rubygems/lodash-rails 3.4.0..*
  • rubygems/lodash-rails 3.5.0..*
  • rubygems/lodash-rails 3.6.0..*
  • rubygems/lodash-rails 3.7.0..*
  • rubygems/lodash-rails 3.9.3..*
  • rubygems/lodash-rails 4.0.0..*
  • rubygems/lodash-rails 4.11.2..*
  • rubygems/lodash-rails 4.12.0..*
  • rubygems/lodash-rails 4.13.1..*
  • rubygems/lodash-rails 4.14.1..*
  • rubygems/lodash-rails 4.15.0..*
  • rubygems/lodash-rails 4.16.1..*
  • rubygems/lodash-rails 4.16.3..*
  • rubygems/lodash-rails 4.16.4..*
  • rubygems/lodash-rails 4.16.6..*
  • rubygems/lodash-rails 4.17.10..*
  • rubygems/lodash-rails 4.17.2..*
  • rubygems/lodash-rails 4.17.4..*
  • rubygems/lodash-rails 4.17.5..*
  • rubygems/lodash-rails 4.3.0..*
  • rubygems/lodash-rails 4.5.1..*
  • rubygems/lodash-rails 4.6.1..*

Description

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Source: BSI WID PortalBSI CSAFOSV (Open Source Vulnerabilities)cvelistv5NVD (NIST)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

npmlodash
rubygemslodash-rails
0.10.00.7.00.8.10.8.20.9.00.9.10.9.21.0.0.rc.11.0.0.rc.21.0.0.rc.31.0.11.1.01.1.11.2.01.2.11.3.12.0.02.1.02.2.02.2.12.3.02.4.02.4.13.1.03.10.03.10.13.2.03.3.03.3.13.3.1.13.4.03.5.03.6.03.7.03.9.34.0.04.11.24.12.04.13.14.14.14.15.04.16.14.16.34.16.44.16.64.17.104.17.2

Metrics

XIEM Effective CVSS
5.6
Source: nvd-v3
EPSS percentile
74.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
medium
Priority score
72.28
Exploit maturity
no public PoC known
CVSS v3
5.6
EPSS score
1.6 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2019-02-07 18:16 UTC
CWE
CWE-400

Weakness classes (CWE)

  • CWE-400Class

    Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

    cwe.mitre.org →

References & sources