CVE-2020-28458 Details
Description
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
A prototype pollution vulnerability has been identified in all versions of the DataTables.net package. This issue arises from an incomplete fix for a previous vulnerability, allowing for the injection of properties into JavaScript object prototypes. Such pollution can be exploited to overwrite fundamental attributes, potentially leading to denial-of-service conditions or unauthorized code execution.
Upgrade to DataTables.net version 1.10.25 or 2.1.2 or higher.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datatables datatables.net | < 1.10.23 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 21, 2024 | CVE Modified | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| Aug 15, 2022 | Reanalysis | [email protected] |
| Jul 21, 2021 | CWE Remap | [email protected] |
| Jan 5, 2021 | Reanalysis | [email protected] |
| Dec 18, 2020 | Initial Analysis | [email protected] |