CVE-2020-7618
Prototype Pollution in sds
CVE-2020-7618 is a medium vulnerability (CVSS 5.3) in Moxa Sds, published April 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 67th percentile. Fixed in sds 4.0.0.
- Severity
- 5.3 MediumCVSS 3.1, NVD
- Exploit chance
- 1.14%EPSS, 67th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.0.0sds
Description
sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sdsnpm | before 4.0.0 | 4.0.0 |
What each source reports
NVD Score used
sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
- Record
CVE-2020-7618- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE ListNo score
sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
- Record
CVE-2020-7618- Updated
- 2026-11-02
EUVDEUVD-2020-1002No score
sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
- Record
EUVD-2020-1002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cxm3-284p-qc4v
Prototype Pollution in sds
Affected versions of sds are vulnerable to prototype pollution. The set function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
Upgrade to version 4.0.0 or later
- Record
GHSA-cxm3-284p-qc4v- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-915, CWE-1321
- Updated
- 2026-11-02
OSVGHSA-cxm3-284p-qc4v
Prototype Pollution in sds
Affected versions of sds are vulnerable to prototype pollution. The set function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.
Recommendation
Upgrade to version 4.0.0 or later
- Record
GHSA-cxm3-284p-qc4v- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321, CWE-915
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.