CVE-2023-0163

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0163

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

mproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still, a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. This issue affects Convict: before 6.2.4.

References
Link Resource
https://github.com/mozilla/node-convict/issues/410 Exploit Issue Tracking
https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*
History

15 Oct 2025, 17:51

Type Values Removed Values Added
References () https://github.com/mozilla/node-convict/issues/410 - () https://github.com/mozilla/node-convict/issues/410 - Exploit, Issue Tracking
References () https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf - () https://github.com/mozilla/node-convict/security/advisories/GHSA-4jrm-c32x-w4jf - Vendor Advisory
CPE cpe:2.3:a:mozilla:convict:*:*:*:*:*:node.js:*:*
First Time Mozilla convict
Mozilla

27 Nov 2024, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.4
Summary
  • (es) Vulnerabilidad de modificación controlada incorrectamente de atributos de prototipos de objetos ("contaminación de prototipos") en Mozilla Convict. Esto permite a un atacante inyectar atributos que se utilizan en otros componentes o anular atributos existentes con otros que tienen un tipo incompatible, lo que puede provocar un bloqueo. El principal caso de uso de Convict es para gestionar configuraciones del lado del servidor escritas por los administradores que poseen los servidores y no por usuarios aleatorios. Por lo tanto, es poco probable que un administrador saboteara deliberadamente su propio servidor. Aun así, puede ocurrir una situación en la que un administrador que no tenga conocimientos de JavaScript pueda ser engañado por un atacante para que escriba el código JavaScript malicioso en algunos archivos de configuración. Este problema afecta a Convict: antes de la versión 6.2.4.

26 Nov 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-26 12:15

Updated : 2025-10-15 17:51

NVD link : CVE-2023-0163

Mitre link : CVE-2023-0163

CVE.ORG link : CVE-2023-0163

JSON object : View

Products Affected

mozilla

CWE
CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')