CVE-2018-3728

mediumPriorität · verfolgen · 36EPSS 0.042 · 91. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

4.19% (91st) EPSS

CVSS 6.5 · medium

Is it mine?

26 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenrhmap46/fh-aaa@sha256:333fe3a6104328fdf7a163e6782bdc93083f5824a71c172e1a91d8cd2ac4dc45_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-appstore@sha256:ea7077344b9a93df67469b205b84297d9f148f8ede6c5275a934247bb5308cca_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-mbaas@sha256:978137bd62f018ed791f8f242e4f454aa5632260b74416a697af2788f6fa55bc_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-messaging@sha256:969cf2d92202354e4aca3cf2550ab7c06d1c1d9557d9498b111de792b659aba2_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-metrics@sha256:4ae06c04142b0b146ca8a3da6da113d2600fd46307f501043c3a23040d89d2b0_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-ngui@sha256:b5dd33fabd680944f0075f6788ac3b5263a11a542ce51e6705dc0ad94aded656_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-scm@sha256:5ce3e868c6c1a8a86c1bf29ddf0e08e82827d4a39eafd8c5f36229a83f4c880b_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-sdks@sha256:91c35fb5b97a5487aac0db2e45d2aa9c22b8ae2fe96e564c333b89b8c1023683_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-statsd@sha256:55122c42b06eb1202e471247b8f9e1a6af1f855ebd620af74d0c338665bba603_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/fh-supercore@sha256:5400eb2ef4cf354c94c47439e5d3ef4bd355a8951463f0ccb9db40e313cb509e_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/gitlab-shell@sha256:e167f23019582aaca1791ba5f8c26825ea62d9885f6a06362f0a6648137381c7_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/httpd@sha256:338594491055c702411209edb55673d5718285fbf8e6d9241d8963ba929c3754_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/installer@sha256:940137b25079909c06b724d838a48db58a98d49baf3cb9eee0e0a068deba44bb_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/memcached@sha256:65d5a737ae9380a7a041726a33c0b36e4065ec9ea6890d327034f03bb1ce0969_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/millicore@sha256:babc8754be2c766a22461ce88b22fe18d17da84091e0dc4dd9e0edba8199e8f5_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/mongodb@sha256:bcfd94b74bfb049fc6c5649216d703f15fe22c2caf30121ade844760fdefc601_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/mysql@sha256:e95585839f27c671609e0bafdb0c3e6752b114882b25b1b35d817142e738a597_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/nagios@sha256:321690d3b24c6281ee7b3bee9b7388676b96b5f3f2a6841bedc872614d73ecd8_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/redis@sha256:752ce940961048a174863aef559c8e303387f67bdbdbe1d91b197c9bbe7f773a_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/ups-eap@sha256:22ef1c2136573a99f278d5f1b384ee35244382a92a3ea2190e74d8ad660f009c_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264
Behobenrhmap46/wildcard-proxy@sha256:5abb752987bde3c20273f9b19266bd8ba2015a06336980f8cf02e3a1f969dbf8_amd64 as a component of Red Hat Mobile Application Platform 4.6redhat_csaf
The container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com using the docker pull command. Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
https://access.redhat.com/errata/RHSA-2018:1264

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 2.9–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4

v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.08.8highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.08.1highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.02.9lowCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-471USprimärCWE-1321USCWE-20US

betroffene Produkte (26)

Betroffene Produkte und Versionsbereiche.

hapi hoek node module≤ Versions before 5.0.3enisa_euvdEU
hapijs hoek< 4.2.0nvdUScpe:2.3:a:hapijs:hoek:*:*:*:*:*:*:*:*
hapijs hoek5.0.0 → 5.0.3nvdUScpe:2.3:a:hapijs:hoek:*:*:*:*:*:*:*:*
npm hoek< 4.2.1osvUSpkg:npm/hoek
npm hoek5.0.0 → 5.0.3osvUSpkg:npm/hoek
rhmap46/fh-aaa@sha256:333fe3a6104328fdf7a163e6782bdc93083f5824a71c172e1a91d8cd2ac4dc45_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-appstore@sha256:ea7077344b9a93df67469b205b84297d9f148f8ede6c5275a934247bb5308cca_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-mbaas@sha256:978137bd62f018ed791f8f242e4f454aa5632260b74416a697af2788f6fa55bc_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-messaging@sha256:969cf2d92202354e4aca3cf2550ab7c06d1c1d9557d9498b111de792b659aba2_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-metrics@sha256:4ae06c04142b0b146ca8a3da6da113d2600fd46307f501043c3a23040d89d2b0_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-ngui@sha256:b5dd33fabd680944f0075f6788ac3b5263a11a542ce51e6705dc0ad94aded656_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-scm@sha256:5ce3e868c6c1a8a86c1bf29ddf0e08e82827d4a39eafd8c5f36229a83f4c880b_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-sdks@sha256:91c35fb5b97a5487aac0db2e45d2aa9c22b8ae2fe96e564c333b89b8c1023683_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-statsd@sha256:55122c42b06eb1202e471247b8f9e1a6af1f855ebd620af74d0c338665bba603_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/fh-supercore@sha256:5400eb2ef4cf354c94c47439e5d3ef4bd355a8951463f0ccb9db40e313cb509e_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/gitlab-shell@sha256:e167f23019582aaca1791ba5f8c26825ea62d9885f6a06362f0a6648137381c7_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/httpd@sha256:338594491055c702411209edb55673d5718285fbf8e6d9241d8963ba929c3754_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/installer@sha256:940137b25079909c06b724d838a48db58a98d49baf3cb9eee0e0a068deba44bb_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/memcached@sha256:65d5a737ae9380a7a041726a33c0b36e4065ec9ea6890d327034f03bb1ce0969_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS
rhmap46/millicore@sha256:babc8754be2c766a22461ce88b22fe18d17da84091e0dc4dd9e0edba8199e8f5_amd64 as a component of Red Hat Mobile Application Platform 4.6alle Versionenfixedredhat_csafUS

20 von 26 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2018:1264Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 Release - Container Images2018-04-30csaf · redhat_csafUS
Red Hat Mobile Application Platform 4.6.0 Release - Container Images
GHSA-jp4x-w63m-7wgmPrototype Pollution in hoek2018-04-26ghsa · osvUS
Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution. The `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property. This can be demonstrated like so: ```javascript var Hoek = require('hoek'); var malicious_payload = '{"__proto__":{"oops":"It works !"}}'; var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops); ``` This type of attack can be used to overwrite existing properties causing a potential denial of service. ## Recommendation Update to version 4.2.1, 5.0.3 or later.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv redhat_csaf NVD CVE.org MITRE

veröffentlicht 2018-03-30geändert 2026-06-17

verwandt (51)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2020-8158US	critical9.8	2.12% (82nd)	Exploit	2020-09-18
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attac…
CVE-2022-21824US	high8.2	21.5% (98th)	—	2022-02-24
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing…
CVE-2022-25893US	critical9.8	1.54% (75th)	—	2022-12-21
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability le…
CVE-2020-26245US	critical9.8	2.23% (83rd)	—	2020-11-27
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to av…
CVE-2020-15256US	critical9.8	1.55% (75th)	—	2020-10-19
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if ver…

+46 weitere

Referenzen (24)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan