CVEFinder.io

CVE-2019-10744

⛔ critical
🔍 Scan for this CVE
Summary

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS Score
9.1
Critical
EPSS Score
2.4
Exploit Probability
Published Date
2019-07-26
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 87.7% of all 335,187 vulnerabilities in our database.

#41,089
Top 25% most severe
Severity Percentile
Last Modified 2024-11-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE IDs (Weakness Types)
CWE-1321

📦 Affected Products 79

Vendor Product Status Affected Versions
f5 big-ip_local_traffic_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_local_traffic_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_local_traffic_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_local_traffic_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_local_traffic_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_global_traffic_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_global_traffic_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_global_traffic_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_global_traffic_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_global_traffic_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_application_security_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_application_security_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_application_security_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_application_security_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_application_security_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_access_policy_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_access_policy_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_access_policy_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_access_policy_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_access_policy_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_edge_gateway Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_edge_gateway Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_edge_gateway Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_edge_gateway Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_edge_gateway Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_application_acceleration_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_application_acceleration_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_application_acceleration_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_application_acceleration_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_application_acceleration_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_advanced_firewall_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_advanced_firewall_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_advanced_firewall_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_advanced_firewall_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_advanced_firewall_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_analytics Affected
≥ 12.1.0 ≤ 12.1.5
f5 big-ip_analytics Affected
≥ 13.1.0 ≤ 13.1.3
f5 big-ip_analytics Affected
≥ 14.1.0 ≤ 14.1.2
f5 big-ip_analytics Affected
≥ 15.0.0 < 15.0.1.3
f5 big-ip_analytics Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_link_controller Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_link_controller Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_link_controller Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_link_controller Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_link_controller Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_policy_enforcement_manager Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_policy_enforcement_manager Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_policy_enforcement_manager Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_policy_enforcement_manager Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_policy_enforcement_manager Affected
≥ 15.1.0 < 15.1.0.2
f5 big-ip_webaccelerator Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_webaccelerator Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_webaccelerator Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_webaccelerator Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_webaccelerator Affected
≥ 15.1.0 < 15.1.0.2
f5 big-iq_centralized_management Affected
≥ 6.0.0 ≤ 6.1.0
f5 big-iq_centralized_management Affected
v5.4.0
f5 big-iq_centralized_management Affected
v7.0.0
f5 big-ip_domain_name_system Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_domain_name_system Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_domain_name_system Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_domain_name_system Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_domain_name_system Affected
≥ 15.1.0 < 15.1.0.2
netapp service_level_manager Affected
v-
redhat virtualization_manager Affected
v4.3
f5 big-ip_fraud_protection_service Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_fraud_protection_service Affected
≥ 13.1.0 < 13.1.3.4
f5 big-ip_fraud_protection_service Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_fraud_protection_service Affected
≥ 15.0.0 < 15.0.1.4
f5 big-ip_fraud_protection_service Affected
≥ 15.1.0 < 15.1.0.2
f5 iworkflow Affected
v2.3.0
lodash lodash Affected
< 4.17.12
netapp active_iq_unified_manager Affected
v-
oracle banking_extensibility_workbench Affected
v14.3.0
oracle banking_extensibility_workbench Affected
v14.4.0
f5 big-ip_application_visibility_and_reporting Affected
≥ 12.1.0 < 12.1.5.2
f5 big-ip_application_visibility_and_reporting Affected
≥ 13.1.0 ≤ 13.1.3
f5 big-ip_application_visibility_and_reporting Affected
≥ 14.1.0 < 14.1.2.5
f5 big-ip_application_visibility_and_reporting Affected
≥ 15.1.0 < 15.1.1

🔗 References 6

https://access.redhat.com/errata/RHSA-2019:3024
Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0...
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-450202
Exploit Third Party Advisory
https://support.f5.com/csp/article/K47105354?utm_sou...
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-40699 🔶 medium 6.5 0.3 A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticat... 2026-05-13
CVE-2026-40703 🔶 medium 5.4 0.1 A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility.  Note: S... 2026-05-13
CVE-2026-41217 ⚠️ high 7.9 0.1 A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with ... 2026-05-13
CVE-2026-41218 ⚠️ high 7.5 0.3 When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIF... 2026-05-13
CVE-2026-41219 🔶 medium 6.5 0.3 An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read... 2026-05-13
CVE-2026-41225 ⛔ critical 9.1 0.3 A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role... 2026-05-13
These CVEs affect the same products