CVE-2020-28503

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	copy-props	>= unspecified, < 2.0.5

References

https://github.com/gulpjs/copy-props/pull/7Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088047Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-COPYPROPS-1082870Exploit, Third Party Advisory
https://github.com/gulpjs/copy-props/pull/7Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088047Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-COPYPROPS-1082870Exploit, Third Party Advisory

Timeline

Published: Mar 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that ar CVE-2020-28534.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar CVE-2020-28548.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-28558.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Admin). Supported versions that are affected are 12.1.1-CVE-2020-28568.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-28578.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-285727.8A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with addition CVE-2020-285735.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285747.5A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow CVE-2020-285756.7A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate CVE-2020-285765.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated