3.7 - CVE-2023-30857

Executive Summary

Informations
Name	CVE-2023-30857	First vendor Publication	2023-04-28
Vendor	Cve	Last vendor Modification	2023-05-08

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Overall CVSS Score	3.7
Base Score	3.7	Environmental Score	3.7
impact SubScore	1.4	Temporal Score	3.7
Exploitabality Sub Score	2.2

Attack Vector	Network	Attack Complexity	High
Privileges Required	None	User Interaction	None
Scope	Unchanged	Confidentiality Impact	None
Integrity Impact	Low	Availability Impact	None
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30857

CPE : Common Platform Enumeration

Type	Description	Count
Application	Aedart Ion cpe:2.3:a:aedart:ion::::::node.js::*	1

Sources (Detail)

Source	Url
MISC	https://github.com/aedart/ion/commit/c3e2ee08710d4164d796ecb66ed291335dae9291 https://github.com/aedart/ion/security/advisories/GHSA-wwxh-74fx-33c6