CVE-2023-0842: xml2js 0.4.23 - Prototype Pollution
xml2js could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0842?
The severity of CVE-2023-0842 is high, with a score of 7.3.
How does CVE-2023-0842 allow an attacker to edit or add new properties to an object?
CVE-2023-0842 allows an attacker to edit or add new properties to an object through prototype pollution.
How can an attacker exploit CVE-2023-0842?
An attacker can exploit CVE-2023-0842 by sending a specially-crafted request.
What software versions are affected by CVE-2023-0842?
Version 0.4.23 of xml2js and versions up to and including 4.x of IBM Watson Knowledge Catalog on-prem are affected by CVE-2023-0842.
Are there any references or additional resources for CVE-2023-0842?
Yes, you can find additional information about CVE-2023-0842 at the following links: [1] https://fluidattacks.com/advisories/myers/ [2] https://github.com/Leonidas-from-XIV/node-xml2js/ [3] https://exchange.xforce.ibmcloud.com/vulnerabilities/252153