{"id":"CVE-2019-10744","details":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","aliases":["GHSA-jf85-cpcp-j695","SNYK-JS-LODASH-450202"],"modified":"2026-08-10T03:46:36.905574379Z","published":"2019-07-26T00:15:11.217Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_access_policy_manager","cpes":["cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_advanced_firewall_manager"},{"vendor_product":"f5:big-ip_analytics","cpes":["cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"last_affected":"12.1.5"},{"introduced":"13.1.0"},{"last_affected":"13.1.3"},{"introduced":"14.1.0"},{"last_affected":"14.1.2"},{"introduced":"15.0.0"},{"fixed":"15.0.1.3"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"f5:big-ip_application_acceleration_manager","cpes":["cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}]},{"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_application_security_manager","cpes":["cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*"]},{"vendor_product":"f5:big-ip_application_visibility_and_reporting","cpes":["cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"last_affected":"13.1.3"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.1.0"},{"fixed":"15.1.1"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"f5:big-ip_domain_name_system","cpes":["cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}]},{"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_edge_gateway","cpes":["cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*"]},{"vendor_product":"f5:big-ip_fraud_protection_service","cpes":["cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","vendor_product":"f5:big-ip_global_traffic_manager","cpes":["cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}]},{"source":"CPE_RANGE","vendor_product":"f5:big-ip_link_controller","cpes":["cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}]},{"cpes":["cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_local_traffic_manager"},{"source":"CPE_RANGE","vendor_product":"f5:big-ip_policy_enforcement_manager","cpes":["cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}]},{"extracted_events":[{"introduced":"12.1.0"},{"fixed":"12.1.5.2"},{"introduced":"13.1.0"},{"fixed":"13.1.3.4"},{"introduced":"14.1.0"},{"fixed":"14.1.2.5"},{"introduced":"15.0.0"},{"fixed":"15.0.1.4"},{"introduced":"15.1.0"},{"fixed":"15.1.0.2"}],"source":"CPE_RANGE","vendor_product":"f5:big-ip_webaccelerator","cpes":["cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*"]},{"source":"CPE_RANGE","vendor_product":"f5:big-iq_centralized_management","cpes":["cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.0"},{"last_affected":"6.1.0"}]},{"extracted_events":[{"introduced":"5.4.0"},{"last_affected":"5.4.0"},{"introduced":"7.0.0"},{"last_affected":"7.0.0"}],"source":"CPE_STRING","vendor_product":"f5:big-iq_centralized_management","cpes":["cpe:2.3:a:f5:big-iq_centralized_management:5.4.0:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-iq_centralized_management:7.0.0:*:*:*:*:*:*:*"]},{"vendor_product":"f5:iworkflow","cpes":["cpe:2.3:a:f5:iworkflow:2.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.3.0"},{"last_affected":"2.3.0"}],"source":"CPE_STRING"},{"vendor_product":"oracle:banking_extensibility_workbench","cpes":["cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.4.0"},{"last_affected":"14.4.0"}],"source":"CPE_STRING"},{"vendor_product":"redhat:virtualization_manager","cpes":["cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.3"},{"last_affected":"4.3"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3024"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20191004-0005/"},{"type":"ADVISORY","url":"https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-LODASH-450202"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lodash/lodash","events":[{"introduced":"0"},{"fixed":"793f983629f5ccef831360f4d31881bbf6264f8b"}],"database_specific":{"cpe":"cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.17.12"}],"source":"CPE_RANGE"}}],"versions":["4.17.11-npm","4.17.10-npm","4.17.9-npm","4.17.5-npm","4.17.4-npm","4.17.3-npm","4.17.2-npm","4.17.1-npm","4.17.0-npm","4.16.6-npm","4.16.5-npm","4.16.4-npm","4.16.3-npm","4.16.2-npm","4.16.1-npm","4.16.0-npm","4.15.0-npm","4.14.2-npm","4.14.1-npm","4.14.0-npm","4.13.1-npm","4.13.0-npm","4.12.0-npm","4.11.2-npm","4.11.1-npm","4.11.0-npm","4.10.0-npm","4.9.0-npm","4.8.2-npm","4.8.1-npm","4.8.0-npm","4.7.0-npm","4.6.1-npm","4.6.0-npm","4.5.1-npm","4.5.0-npm","4.4.0-npm","4.3.0-npm","4.2.1-npm","4.2.0-npm","4.1.0-npm","4.0.1-npm","4.0.0-npm","3.10.1-npm","3.10.0-npm","3.9.3-npm","3.9.2-npm","3.9.1-npm","3.9.0-npm","3.8.0-npm","3.7.0-npm","3.6.0-npm","3.5.0-npm","3.4.0-npm","3.3.1-npm","3.3.0-npm","3.2.0-npm","3.1.0-npm","3.0.1-npm","3.0.0-npm"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-10744.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}