What’s Vulnerable › Vulnerabilities
CVE-2020-8203: Prototype Pollution in lodash
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-07-15 · updated 2026-06-17
- Weakness: CWE-770
Description
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Affected products
- lodash: before 4.17.20 — fixed in 4.17.20
- Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Extensibility Workbench: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Oracle Banking Liquidity Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Cloud Native Core Policy: 1.11.0
- Oracle Corporation Communications Session Border Controller: 8.4, 9.0, cz8.4
- Oracle Communications Session Router: cz8.4
- Oracle Communications Subscriber-Aware Load Balancer: cz8.3, cz8.4
- Oracle Corporation Enterprise Communications Broker: 3.2.0, 3.3.0, pcz3.3
- Oracle Corporation JD Edwards EnterpriseOne Tools: through 9.2.6.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
- Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.12; from 19.12.0 through 19.12.11; from 20.12.0 through 20.12.7
- Npm Lodash: from 3.7.0 before 4.17.19 — fixed in 4.17.19
- Npm Lodash-Es: from 3.7.0 before 4.17.20 — fixed in 4.17.20
- Npm Lodash.Pick: from 4.0.0 through 4.4.0
- Npm Lodash.Set: from 3.7.0 through 4.3.2
- Npm Lodash.Setwith: through 4.3.2
- Npm Lodash.Update: through 4.10.2
- Npm Lodash.Updatewith: through 4.10.2
- Rubygems Lodash-Rails: from 3.7.0 before 4.17.19; 3.10.0, 3.10.1, 3.7.0, 3.9.3, 4.0.0, 4.11.2 (+18) — fixed in 4.17.19
How to fix
Upgrade to a fixed version: lodash 4.17.20; Oracle Blockchain Platform 21.1.2; Npm Lodash 4.17.19; Npm Lodash-Es 4.17.20; Rubygems Lodash-Rails 4.17.19. Check the vendor advisory for mitigations.
References
- https://github.com/lodash/lodash/issues/4874
- https://hackerone.com/reports/712065
- https://security.netapp.com/advisory/ntap-20200724-0006/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/lodash/lodash/issues/4874
- https://hackerone.com/reports/712065
- https://security.netapp.com/advisory/ntap-20200724-0006/
- https://www.oracle.com//security-alerts/cpujul2021.html
Get alerted when CVE-2020-8203 or the next vulnerability affects your stack