« Volver al listado

CVE-2017-1001003

Estado: ModificadaCrítica (9.8)—

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mathjs Project — Mathjs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1001003",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "46fe6300-5254-4a98-9594-a9567bec8179",
      "affectedData": [
        {
          "vendor": "math.js",
          "product": "math.js",
          "versions": [
            {
              "status": "affected",
              "version": "3.17.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-27T14:29:00.310",
  "references": [
    {
      "url": "https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170",
      "source": "46fe6300-5254-4a98-9594-a9567bec8179"
    },
    {
      "url": "https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761",
      "source": "46fe6300-5254-4a98-9594-a9567bec8179"
    },
    {
      "url": "https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "46fe6300-5254-4a98-9594-a9567bec8179",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object."
    },
    {
      "lang": "es",
      "value": "Las versiones anteriores a la 3.17.0 de math.js tenían un problema por el cual las propiedades privadas como un constructor podían remplazarse empleando caracteres unicode al crear un objeto."
    }
  ],
  "lastModified": "2026-06-17T00:59:18.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mathjs_project:mathjs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1B8015C-31BB-48C5-9028-AD85F11DBF6E",
              "versionEndExcluding": "3.17.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "46fe6300-5254-4a98-9594-a9567bec8179"
}