Threats tagged 'ghsa-q63j-wgh6-mphc'

Padloc versions 4.0.0 up to but not including 4.3.1 contain a prototype pollution vulnerability. This flaw allows SCIM token holders to modify the Object.prototype by sending specially crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function. By manipulating paths such as __proto__.x or constructor.prototype.x, attackers can pollute the shared server process, potentially disrupting requests for all organizations served by that process. The vulnerability has a high severity rating with a CVSS score of 7.6.