Prototype Pollution in NASA Open MCT

Description

In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.0.2

References

• GHSA-4xcx-cwrq-w792
• nasa.github.io
• www.linkedin.com
• CVE-2023-45282
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Path Traversal in general-file-server - CVE-2018-3724
• qs vulnerable to Prototype Pollution - CVE-2022-24999
• Server-Side Request Forgery in axios - CVE-2024-39338
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800

Tags:

npm

openmct