Log in Start free

Vulnerability · Published Jan 19, 2021 · Assigned by snyk

CVE-2020-28472Prototype Pollution

High 7.3

In plain English

A high-severity security flaw in aws-sdk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.2%top 17.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@aws-sdk/shared-ini-file-loader1.0.0-rc.9GHSA-rrc9-gqf8-8rwg
npmaws-sdk2.814.0GHSA-rrc9-gqf8-8rwg

Affected products (as reported)

VendorProductVersions
n/a @aws-sdk/shared-ini-file-loader unspecified – before 1.0.0-rc.9
n/a aws-sdk unspecified – before 2.814.0

References