Description
fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.
Recommendation
Update the fullpage.js package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.2
- Patched version(s): 4.0.2
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in fullpage.js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution in madlib-object-utils - CVE-2022-24279
- steal vulnerable to Prototype Pollution - CVE-2022-37258
- deep-object-diff vulnerable to Prototype Pollution - CVE-2022-41713
- Prototype Pollution in dset - CVE-2022-25645
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023