Security Advisory

CVE-2023-0842

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-04-05 00:00:00

Last updated 2025-12-03 20:14:55

Assigner Fluid Attacks

State PUBLISHED

Description

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

← Browse all CVEs View on cve.org ↗