Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2017-1001003

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

VectorNETWORK

PublishedNov 27, 2017, 14:29

Published By46fe6300-5254-4a98-9594-a9567bec8179

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

mathjs(npm)03.17.0N/A

References

https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170
https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761

Weakness Type

CWE-20

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK