Description (CNA)
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| axios / axios | affected >= 1.0.0, < 1.20.0; affected >= 0.27.2, < 0.34.0 |
CWE
CWE-1321
References
- https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g
- https://github.com/axios/axios/pull/11141
- https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- https://github.com/axios/axios/releases/tag/v0.34.0
- https://github.com/axios/axios/releases/tag/v1.20.0
ADP enrichment
No English description supplied.