CVE-2020-8203: vulnerability facts

CVE-2020-8203

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

CVSS 7.4 · High · EPSS 5.2% · Fix available

Stack: system · node

Affected products and versions

lodash
Versions
- Not Fixed: Affected
No fix published
node-lodash Debian:12
Affected ranges
- ECOSYSTEM: < 4.17.19+dfsg-1
Update to 4.17.19+dfsg-1
node-lodash Debian:13
Affected ranges
- ECOSYSTEM: < 4.17.19+dfsg-1
Update to 4.17.19+dfsg-1
node-lodash Debian:14
Affected ranges
- ECOSYSTEM: < 4.17.19+dfsg-1
Update to 4.17.19+dfsg-1
lodash npm
Affected ranges
- SEMVER: ≥ 3.7.0, < 4.17.19
Update to 4.17.19
lodash-es npm
Affected ranges
- SEMVER: ≥ 3.7.0, < 4.17.20
Update to 4.17.20
lodash.pick npm
Affected ranges
- SEMVER: ≥ 4.0.0, ≤ 4.4.0
No fix published
lodash.set npm
Affected ranges
- SEMVER: ≥ 3.7.0, ≤ 4.3.2
No fix published
lodash.setwith npm
Affected ranges
- SEMVER: ≤ 4.3.2
No fix published
lodash.update npm
Affected ranges
- SEMVER: ≤ 4.10.2
No fix published
lodash.updatewith npm
Affected ranges
- SEMVER: ≤ 4.10.2
No fix published
lodash-rails RubyGems
Versions
- 3.10.0
- 3.10.1
- 3.7.0
- 3.9.3
- 4.0.0
- 4.11.2
- 4.12.0
- 4.13.1
- 4.14.1
- 4.15.0
- 4.16.1
- 4.16.3
- 4.16.4
- 4.16.6
- 4.17.10
- 4.17.11
- 4.17.14
- 4.17.15
- 4.17.2
- 4.17.4
- 4.17.5
- 4.3.0
- 4.5.1
- 4.6.1
Affected ranges
- ECOSYSTEM: ≥ 3.7.0, < 4.17.19
Update to 4.17.19
node-lodash Ubuntu:Pro:18.04:LTS
Versions
- 4.17.4+dfsg-1
Affected ranges
- ECOSYSTEM: < 4.17.4+dfsg-1ubuntu0.1~esm1
Update to 4.17.4+dfsg-1ubuntu0.1~esm1
node-lodash Ubuntu:Pro:20.04:LTS
Versions
- 4.17.11+dfsg-4
- 4.17.15+dfsg-2
Affected ranges
- ECOSYSTEM: < 4.17.15+dfsg-2ubuntu0.1~esm1
Update to 4.17.15+dfsg-2ubuntu0.1~esm1