Skip to content
Fencer Vulns
high 7.5

CVE-2020-28477 json

Prototype Pollution

published 2021-01-19 5 y ago modified 2026-06-17 4 mo ago also GHSA-9qmh-276g-x5pj , EUVD-2021-0500

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

This affects all versions of package immer.

Patch / fix

  • npm immer 8.0.1
  • immer_project immer 8.0.1
  • rhvm rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-engine rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-web-ui rhev manager 4.4 1.6.7-1.el8ev
  • ovirt-engine-setup rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-engine-tools rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-engine-backend rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-engine-restapi rhev manager 4.4 4.4.5.9-0.1.el8ev
  • ovirt-engine-dbscripts rhev manager 4.4 4.4.5.9-0.1.el8ev

red hat advisories RHSA-2021:1169

  • xpp3 Manager Server Module 4.1 1.1.4c-11.2.2
  • smdba Manager Server Module 4.1 1.7.8-0.3.6.2
  • rhnlib Manager Server Module 4.1, Manager Proxy Module 4.1 4.1.3-4.3.2
  • cobbler Manager Server Module 4.1 3.0.0+git20190806.32c4bae0-5.6.4
  • xstream Manager Server Module 4.1 1.4.15-3.5.2
  • mgr-osad Manager Server Module 4.1, Manager Proxy Module 4.1 4.1.5-2.9.4
  • mgr-libmod Manager Server Module 4.1 4.1.7-3.16.2
  • susemanager Manager Server Module 4.1 4.1.24-3.20.2

suse advisories SUSE-SU-2021:0906-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28477 updated cvss 7.5

nodejs-immer: prototype pollution may lead to DoS or remote code execution

  • Red Hat OpenShift Container Platform 4 openshift4/ose-prometheus
    affected: no fix available “Fix deferred”
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.6.7-1.el8ev
    fixed: vendor fix RHSA-2021:1169
  • Red Hat OpenShift Service Mesh 1 kiali, servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus Red Hat OpenShift Service Mesh 2.0 kiali, servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus Red Hat Advanced Cluster Management for Kubernetes 2 configmap-watcher, management-ingress, rhacm2/acmesolver-rhel8, rhacm2/grc-ui-api-rhel8, endpoint-component-operator, rhacm2/kui-web-terminal-rhel8, +2 more Red Hat OpenShift Container Platform 3.11 openshift3/grafana Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-thanos-rhel8 Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.4.5.9-0.1.el8ev, apache-sshd 2.6.0-1.el8ev, ansible-runner 1.4.6-2.el8ar, ovirt-engine 4.4.5.9-0.1.el8ev, ovirt-engine-dwh 4.4.5.5-1.el8ev, apache-sshd-javadoc 2.6.0-1.el8ev, +22 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.34% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-JS-IMMER-1019369 referenced PoC, tagged "exploit" by a source, unverified
  • snyk.io https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1061986 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm immer
>=7.0.0, <8.0.1
8.0.1

Affected products

  • n/a immer

Classification

Weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.