CVE-2020-28448 MEDIUM

CVE-2020-28448: Prototype Pollution

Vendor N/A
Product multi-ini
Published December 22, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.6/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R

What the vulnerability does

01Description

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.

Key dates

02Disclosure timeline

December 22, 2020 CVE published
September 16, 2024 Record updated