CVE-2020-7746 Information

Description

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed the existing options (or the defaults options) are deeply merged with provided options. However during this operation the keys of the object being set are not checked leading to a prototype pollution.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://github.com/chartjs/Chart.js/pull/7920 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1019375 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCHARTJS-1019376 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019374 https://snyk.io/vuln/SNYK-JS-CHARTJS-1018716

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5