CVE-2018-16487: Medium severity Lodash Lodash Node.js vulnerability
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Other sources
A prototype pollution vulnerability was found in lodash 4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
— IBM
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.11 or later.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-16487?
CVE-2018-16487 is a vulnerability in the Node.js lodash module that can be exploited by a remote attacker to cause a denial of service.
How does CVE-2018-16487 work?
CVE-2018-16487 works by allowing a remote attacker to inject properties onto Object.prototype, causing a denial of service condition.
What software is affected by CVE-2018-16487?
The IBM Security Verify Governance version 10.0 is affected by CVE-2018-16487.
What is the severity of CVE-2018-16487?
CVE-2018-16487 has a severity rating of 6.5 (medium).
Where can I find more information about CVE-2018-16487?
You can find more information about CVE-2018-16487 at the following links: - IBM X-Force Exchange: [link](https://exchange.xforce.ibmcloud.com/vulnerabilities/156530) - IBM Support Page: [link](https://www.ibm.com/support/pages/node/7047640)