CVE-2020-28458
Prototype Pollution
CVE-2020-28458 is a high vulnerability (CVSS 7.3) in Datatables Datatables.net, published December 16, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.72%, the 89th percentile. Fixed in datatables.net 1.10.22.
- Severity
- 7.3 HighCVSS 3.1, CVE List
- Exploit chance
- 3.72%EPSS, 89th percentile
- Exploitation
- None known2 public exploits
- Fixed in
1.10.22datatables.net +27 more
Description
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
datatables.netnpm | before 1.10.22 | 1.10.22 |
reaperAzure Linux:2 | before 3.1.1-15 | 3.1.1-15 |
datatables.netTuxCare:npm From an advisory covering 2 CVEs | 1.10.13-tuxcare.0 up to 1.10.13-tuxcare.1, plus listed versions 1.10.13 | 1.10.13-tuxcare.1 |
datatables.netTuxCare:npm From an advisory covering 2 CVEs | 1.10.19-tuxcare.0 up to 1.10.19-tuxcare.1, plus listed versions 1.10.19 | 1.10.19-tuxcare.1 |
ovirt-web-uiRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:1.6.7-1.el8ev | 0:1.6.7-1.el8ev |
ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-backendRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-dbscriptsRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-health-check-bundlerRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-restapiRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ovirt-engine-setupRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-baseRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-cinderlibRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-imageioRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-setup-plugin-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-toolsRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-tools-backupRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-webadmin-portalRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
ovirt-engine-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
python3-ovirt-engine-libRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
rhvmRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs | before 0:4.4.5.9-0.1.el8ev | 0:4.4.5.9-0.1.el8ev |
cockpit-ovirtRed Hat:rhev_hypervisor:4.4::el8 | before 0:0.14.20-1.el8ev | 0:0.14.20-1.el8ev |
cockpit-ovirt-dashboardRed Hat:rhev_hypervisor:4.4::el8 | before 0:0.14.20-1.el8ev | 0:0.14.20-1.el8ev |
ovirt-engine-ui-extensionsRed Hat:rhev_manager:4.4:el8 From an advisory covering 2 CVEs | before 0:1.2.5-1.el8ev | 0:1.2.5-1.el8ev |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | fazilbaig1/CVE-2020-28458 | 2024-10-19 |
| PoC in GitHub | Raka200juta/28458 | 2025-12-04 |
What each source reports
CVE List Score used
Prototype Pollution
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
CVE-2020-28458- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
EUVDEUVD-2020-1499
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
EUVD-2020-1499- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7j4-fhg6-xf5v
datatables.net vulnerable to Prototype Pollution due to incomplete fix
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
GHSA-m7j4-fhg6-xf5v- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
CVE-2020-28458- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVAZL-53184
CVE-2020-28458 affecting package reaper for versions less than 3.1.1-15
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
AZL-53184- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
CVE-2020-28458- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-m7j4-fhg6-xf5v
datatables.net vulnerable to Prototype Pollution due to incomplete fix
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
- Record
GHSA-m7j4-fhg6-xf5v- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVRHSA-2021:1169
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement
- Record
RHSA-2021:1169- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2021:1184
Red Hat Security Advisory: RHV RHEL Host (ovirt-host) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement
- Record
RHSA-2021:1184- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2021:1186
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance
- Record
RHSA-2021:1186- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-13
OSVCLSA-2026-1780620681No score
TuxCare security update for datatables.net (2 CVEs)
TuxCare rebuilt datatables.net to address 2 CVEs. Fixed in 1.10.13-tuxcare.1.
- Record
CLSA-2026-1780620681- Updated
- 2026-11-02
OSVCLSA-2026-1792941558No score
TuxCare security update for datatables.net (2 CVEs)
TuxCare rebuilt datatables.net to address 2 CVEs. Fixed in 1.10.19-tuxcare.1.
- Record
CLSA-2026-1792941558- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402
github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766
Show 77 moreShow less
security.netapp.com/advisory/ntap-20240621-0006
nvd.nist.gov/vuln/detail/CVE-2020-28458
access.redhat.com/errata/RHSA-2021:1169
bugzilla.redhat.com/show_bug.cgi?id=1145658
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1169.json
cve.org/CVERecord?id=CVE-2019-20921