Vulnerability Description
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ajv.Js | Ajv | 6.12.2 |
Related Weaknesses (CWE)
References
- https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release NotesThird Party Advisory
- https://github.com/ajv-validator/ajv/tagsThird Party Advisory
- https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://github.com/ajv-validator/ajv/releases/tag/v6.12.3Release NotesThird Party Advisory
- https://github.com/ajv-validator/ajv/tagsThird Party Advisory
- https://hackerone.com/bugs?subject=user&report_id=894259Permissions Required
- https://security.netapp.com/advisory/ntap-20240621-0007/
FAQ
What is CVE-2020-15366?
CVE-2020-15366 is a vulnerability with a CVSS score of 5.6 (MEDIUM). An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollutio...
How severe is CVE-2020-15366?
CVE-2020-15366 has been rated MEDIUM with a CVSS base score of 5.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15366?
Check the references section above for vendor advisories and patch information. Affected products include: Ajv.Js Ajv.