Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

According to its self-reported version number, Lodash is prior to 4.17.12. It is, therefore, affected by a prototype pollution vulnerability in the function defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties     (CVE-2019-10744)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory.

  - Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep     could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
    (CVE-2019-10744)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.2 or 7.x prior to 7.2.1. It is, therefore, affected by :

 - A prototype pollution vulnerability in lodash. (CVE-2019-10744)

 - A server-side request forgery (SSRF) vulnerability in the graphite integration for Timelion visualizer. (CVE-2019-7616)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for ovirt-web-ui is now available for Red Hat Virtualization Engine 4.3.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The ovirt-web-ui package provides the web interface for Red Hat Virtualization.

Security Fix(es) :

* nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Known moderate severity security vulnerability detected by GitHub on ovirt-web-ui components (BZ#1694032)

ID	Name	Product	Family	Severity
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	critical
113008	Lodash < 4.17.12 Prototype Pollution	Web App Scanning	Component Vulnerability	critical
137064	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)	Nessus	Red Hat Local Security Checks	critical
135940	F5 Networks BIG-IP : Lodash library vulnerability (K47105354)	Nessus	F5 Networks Local Security Checks	critical
98980	Kibana 7.x < 7.2.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98979	Kibana < 6.8.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
129862	RHEL 7 : Virtualization Manager (RHSA-2019:3024)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-10744

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical