CVE-2019-10744

⛔ critical

Summary

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS Score

9.1

Critical

EPSS Score

2.4

Exploit Probability

Published Date

2019-07-26

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 87.6% of all 365,863 vulnerabilities in our database.

#45,273

Top 25% most severe

Severity Percentile

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE IDs (Weakness Types)

CWE-1321

📦 Affected Products 79

Vendor	Product	Status	Affected Versions
f5	big-ip_local_traffic_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_local_traffic_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_local_traffic_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_local_traffic_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_local_traffic_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_global_traffic_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_global_traffic_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_global_traffic_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_global_traffic_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_global_traffic_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_application_security_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_application_security_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_application_security_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_application_security_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_application_security_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_access_policy_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_access_policy_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_access_policy_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_access_policy_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_access_policy_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_edge_gateway	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_edge_gateway	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_edge_gateway	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_edge_gateway	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_edge_gateway	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_application_acceleration_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_application_acceleration_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_application_acceleration_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_application_acceleration_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_application_acceleration_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_advanced_firewall_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_advanced_firewall_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_advanced_firewall_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_advanced_firewall_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_advanced_firewall_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_analytics	Affected	≥ 12.1.0 ≤ 12.1.5
f5	big-ip_analytics	Affected	≥ 13.1.0 ≤ 13.1.3
f5	big-ip_analytics	Affected	≥ 14.1.0 ≤ 14.1.2
f5	big-ip_analytics	Affected	≥ 15.0.0 < 15.0.1.3
f5	big-ip_analytics	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_link_controller	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_link_controller	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_link_controller	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_link_controller	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_link_controller	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_policy_enforcement_manager	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_policy_enforcement_manager	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_policy_enforcement_manager	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_policy_enforcement_manager	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_policy_enforcement_manager	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-ip_webaccelerator	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_webaccelerator	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_webaccelerator	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_webaccelerator	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_webaccelerator	Affected	≥ 15.1.0 < 15.1.0.2
f5	big-iq_centralized_management	Affected	≥ 6.0.0 ≤ 6.1.0
f5	big-iq_centralized_management	Affected	v5.4.0
f5	big-iq_centralized_management	Affected	v7.0.0
f5	big-ip_domain_name_system	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_domain_name_system	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_domain_name_system	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_domain_name_system	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_domain_name_system	Affected	≥ 15.1.0 < 15.1.0.2
netapp	service_level_manager	Affected	v-
redhat	virtualization_manager	Affected	v4.3
f5	big-ip_fraud_protection_service	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_fraud_protection_service	Affected	≥ 13.1.0 < 13.1.3.4
f5	big-ip_fraud_protection_service	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_fraud_protection_service	Affected	≥ 15.0.0 < 15.0.1.4
f5	big-ip_fraud_protection_service	Affected	≥ 15.1.0 < 15.1.0.2
f5	iworkflow	Affected	v2.3.0
lodash	lodash	Affected	< 4.17.12
netapp	active_iq_unified_manager	Affected	v-
oracle	banking_extensibility_workbench	Affected	v14.3.0
oracle	banking_extensibility_workbench	Affected	v14.4.0
f5	big-ip_application_visibility_and_reporting	Affected	≥ 12.1.0 < 12.1.5.2
f5	big-ip_application_visibility_and_reporting	Affected	≥ 13.1.0 ≤ 13.1.3
f5	big-ip_application_visibility_and_reporting	Affected	≥ 14.1.0 < 14.1.2.5
f5	big-ip_application_visibility_and_reporting	Affected	≥ 15.1.0 < 15.1.1

🔗 References 6

https://access.redhat.com/errata/RHSA-2019:3024

Third Party Advisory

https://security.netapp.com/advisory/ntap-20191004-0...

Third Party Advisory

https://snyk.io/vuln/SNYK-JS-LODASH-450202

Exploit Third Party Advisory

https://support.f5.com/csp/article/K47105354?utm_sou...

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Patch Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Patch Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-94127	⛔ critical	9.8	2.2	When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can ...	2026-09-22
CVE-2026-63020	ℹ️ low	3.1	0.2	A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error mes...	2026-09-02
CVE-2026-40699	🔶 medium	6.5	0.3	A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticat...	2026-05-13
CVE-2026-40703	🔶 medium	5.4	0.1	A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: S...	2026-05-13
CVE-2026-41217	⚠️ high	7.9	0.1	A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with ...	2026-05-13
CVE-2026-41218	⚠️ high	7.5	0.3	When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIF...	2026-05-13

These CVEs affect the same products