CVE-2017-1001003
27.11.2017, 14:29
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
| Vendor | Product | Version |
|---|---|---|
| mathjs_project | mathjs | 𝑥 < 3.17.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
References