VYPR
High severity7.4NVD Advisory· Published Jul 15, 2020· Updated Jun 17, 2026

CVE-2020-8203

CVE-2020-8203

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
lodashnpm
>= 3.7.0, < 4.17.194.17.19
lodash-esnpm
>= 3.7.0, < 4.17.204.17.20
lodash.picknpm
>= 4.0.0, <= 4.4.0
lodash.setnpm
>= 3.7.0, <= 4.3.2
lodash.setwithnpm
<= 4.3.2
lodash.updatenpm
<= 4.10.2
lodash.updatewithnpm
<= 4.10.2
lodash-railsRubyGems
>= 3.7.0, < 4.17.194.17.19

Affected products

48
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*
    Range: <4.17.20
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_liquidity_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_liquidity_management:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
    Range: <21.1.2
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
    Range: <=9.2.6.0
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*
    Range: >=17.12.0,<=17.12.11
  • lodash/lodashdescription
  • ghsa-coords8 versions
    >= 3.7.0, < 4.17.19+ 7 more
    • (no CPE)range: >= 3.7.0, < 4.17.19
    • (no CPE)range: >= 3.7.0, < 4.17.19
    • (no CPE)range: >= 3.7.0, < 4.17.20
    • (no CPE)range: >= 4.0.0, <= 4.4.0
    • (no CPE)range: >= 3.7.0, <= 4.3.2
    • (no CPE)range: <= 4.3.2
    • (no CPE)range: <= 4.10.2
    • (no CPE)range: <= 4.10.2

Patches

Vulnerability mechanics

References

17

News mentions

0

No linked articles in our index yet.