Threats tagged 'ghsa-wp43-fqwr-5f5j'

A prototype pollution vulnerability exists in the setter utility of @progress/kendo-react-common used in Progress Software KendoReact versions 3.5.0 through 16.0.0. This flaw allows a high-privileged attacker who can control a field path passed to the utility, either directly or via components like Form, Scheduler, and Gantt, to modify the prototype of built-in JavaScript objects. The impact on confidentiality, integrity, and availability is limited. The vulnerability has a CVSS score of 4.1, indicating medium severity.