CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HCVE-2020-8203
High (7.4). EPSS 5.2% chance of exploitation in the next 30 days. Fixed in lodash 4.17.19.
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Severity
- EPSS
- 5.2% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-1321, CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lodash:lodash
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_extensibility_workbench
- oracle:banking_liquidity_management
- oracle:banking_supply_chain_finance
- oracle:banking_trade_finance_process_management
- oracle:banking_virtual_account_management
- oracle:blockchain_platform
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_policy
- oracle:communications_session_border_controller
- oracle:communications_session_router
- oracle:communications_subscriber-aware_load_balancer
- oracle:enterprise_communications_broker
- oracle:jd_edwards_enterpriseone_tools
- oracle:peoplesoft_enterprise_peopletools
- oracle:primavera_gateway
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6mc-m468-83gw | npm | lodash | >=3.7.0 <4.17.19 | 4.17.19 |
| GHSA-p6mc-m468-83gw | npm | lodash-es | >=3.7.0 <4.17.20 | 4.17.20 |
| GHSA-p6mc-m468-83gw | npm | lodash.pick | >=4.0.0 <=4.4.0 | no fix published |
| GHSA-p6mc-m468-83gw | npm | lodash.set | >=3.7.0 <=4.3.2 | no fix published |
| GHSA-p6mc-m468-83gw | npm | lodash.setwith | <=4.3.2 | no fix published |
| GHSA-p6mc-m468-83gw | npm | lodash.update | <=4.10.2 | no fix published |
| GHSA-p6mc-m468-83gw | npm | lodash.updatewith | <=4.10.2 | no fix published |
| GHSA-p6mc-m468-83gw | RubyGems | lodash-rails | >=3.7.0 <4.17.19 | 4.17.19 |