CVE-2018-3723: defaults-deep_project defaults-deep
Vulnerability summary
CVE-2018-3723 is a high (CVSS 8.8) vulnerability in defaults-deep_project defaults-deep. EPSS estimates a 2.00% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-06-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.00%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
-0.03 pp
From 2.04% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-471Modification of Assumed-Immutable Data (MAID)The product does not properly protect an assumed-immutable element from being modified by an attacker.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Defaults-deep_project1 product
- defaults-deep< 0.2.4
Hackerone1 product
- defaults-deep node moduleVersions before 0.2.4
Npm1 product
- defaults-deep< 0.2.4
3 vendors · 3 products
References
5 links- github.com/jonschlinkert/defaults-deep/commit/c873f341327ad885ff4d0f23b3d3bca31b0343e5X Refsource MISCPatchThird Party AdvisoryWEB
