CVE-2023-0163

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-0163", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2023-01-10T18:24:38.341Z", "datePublished": "2024-11-26T11:36:26.574Z", "dateUpdated": "2024-11-27T16:02:29.836Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Convict", "vendor": "Mozilla", "versions": [{"lessThan": "6.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "analyst", "value": "Captain-K-101"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.</p><p>This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n</p><div><p>The main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.</p></div><p>This issue affects Convict: before 6.2.4.</p>"}], "value": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.\n\nThis allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n\n\nThe main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.\n\n\n\nThis issue affects Convict: before 6.2.4."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-11-26T11:36:26.574Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/mozilla/node-convict/issues/410"}, {"tags": ["vendor-advisory"], "url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf"}], "source": {"discovery": "UNKNOWN"}, "title": "Prototype Pollution in convict", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "mozilla", "product": "convict", "cpes": ["cpe:2.3:a:mozilla:convict:-:*:*:*:*:node.js:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "6.2.4", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-27T15:59:57.809994Z", "id": "CVE-2023-0163", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T16:02:29.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-0163", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-27T15:59:57.809994Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mozilla:convict:-:*:*:*:*:node.js:*:*"], "vendor": "mozilla", "product": "convict", "versions": [{"status": "affected", "version": "0", "lessThan": "6.2.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T16:02:22.541Z"}}], "cna": {"title": "Prototype Pollution in convict", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "analyst", "value": "Captain-K-101"}], "affected": [{"vendor": "Mozilla", "product": "Convict", "versions": [{"status": "affected", "version": "0", "lessThan": "6.2.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/mozilla/node-convict/issues/410", "tags": ["issue-tracking"]}, {"url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.\n\nThis allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n\n\nThe main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.\n\n\n\nThis issue affects Convict: before 6.2.4.", "supportingMedia": [{"type": "text/html", "value": "<p>Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.</p><p>This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n</p><div><p>The main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.</p></div><p>This issue affects Convict: before 6.2.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-11-26T11:36:26.574Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0163", "state": "PUBLISHED", "dateUpdated": "2024-11-27T16:02:29.836Z", "dateReserved": "2023-01-10T18:24:38.341Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2024-11-26T11:36:26.574Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Convict", "vendor": "Mozilla", "versions": [{"lessThan": "6.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@mozilla.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:mozilla:convict:-:*:*:*:*:node.js:*:*"], "defaultStatus": "unknown", "product": "convict", "vendor": "mozilla", "versions": [{"lessThan": "6.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "BC60C785-948E-48D0-9A6B-F9BEA49B9B18", "versionEndExcluding": "6.2.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict.\n\nThis allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash.\n\n\nThe main use case of Convict is for handling server-side \nconfigurations written by the admins owning the servers, and not random \nusers. So it's unlikely that an admin would deliberately sabotage their \nown server. Still, a situation can happen where an admin not \nknowledgeable about JavaScript could be tricked by an attacker into \nwriting the malicious JavaScript code into some config files.\n\n\n\nThis issue affects Convict: before 6.2.4."}, {"lang": "es", "value": "Vulnerabilidad de modificaci\u00f3n controlada incorrectamente de atributos de prototipos de objetos (\"contaminaci\u00f3n de prototipos\") en Mozilla Convict. Esto permite a un atacante inyectar atributos que se utilizan en otros componentes o anular atributos existentes con otros que tienen un tipo incompatible, lo que puede provocar un bloqueo. El principal caso de uso de Convict es para gestionar configuraciones del lado del servidor escritas por los administradores que poseen los servidores y no por usuarios aleatorios. Por lo tanto, es poco probable que un administrador saboteara deliberadamente su propio servidor. Aun as\u00ed, puede ocurrir una situaci\u00f3n en la que un administrador que no tenga conocimientos de JavaScript pueda ser enga\u00f1ado por un atacante para que escriba el c\u00f3digo JavaScript malicioso en algunos archivos de configuraci\u00f3n. Este problema afecta a Convict: antes de la versi\u00f3n 6.2.4."}], "id": "CVE-2023-0163", "lastModified": "2026-06-17T05:24:55.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-0163", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-27T15:59:57.809994Z", "version": "2.0.3"}}]}, "published": "2024-11-26T12:15:17.390", "references": [{"source": "security@mozilla.org", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/mozilla/node-convict/issues/410"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security@mozilla.org", "type": "Secondary"}]}

{}

{}