Dashboard / CVE-2020-8203

CVE-2020-8203

HIGH 1 PoC
MEDIUM Priority: 0.39 BB Relevance: 76/100
Published: 2020-07-15 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Network No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: Unchanged
C: None
I: High
A: High

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Weakness Classification (2)

Affected Software (40)

VendorProductVersion
lodash lodash < 4.17.20
n/a lodash Not Fixed
oracle banking_corporate_lending_process_management 14.2.0
oracle banking_corporate_lending_process_management 14.3.0
oracle banking_corporate_lending_process_management 14.5.0
oracle banking_credit_facilities_process_management 14.2.0
oracle banking_credit_facilities_process_management 14.3.0
oracle banking_credit_facilities_process_management 14.5.0
oracle banking_extensibility_workbench 14.2.0
oracle banking_extensibility_workbench 14.3.0
oracle banking_extensibility_workbench 14.5.0
oracle banking_liquidity_management 14.2.0
oracle banking_liquidity_management 14.3.0
oracle banking_liquidity_management 14.5.0
oracle banking_supply_chain_finance 14.2.0
oracle banking_supply_chain_finance 14.3.0
oracle banking_supply_chain_finance 14.5.0
oracle banking_trade_finance_process_management 14.2.0
oracle banking_trade_finance_process_management 14.3.0
oracle banking_trade_finance_process_management 14.5.0
oracle banking_virtual_account_management 14.2.0
oracle banking_virtual_account_management 14.3.0
oracle banking_virtual_account_management 14.5.0
oracle blockchain_platform < 21.1.2
oracle communications_billing_and_revenue_management 7.5.0.23.0
oracle communications_billing_and_revenue_management 12.0.0.3.0
oracle communications_cloud_native_core_policy 1.11.0
oracle communications_session_border_controller 8.4
oracle communications_session_border_controller 9.0
oracle communications_session_border_controller cz8.4
Showing 30 of 40 entries

References & Advisories (8)

https://github.com/lodash/lodash/issues/4874
Issue Tracking Vendor Advisory
https://hackerone.com/reports/712065
Exploit Third Party Advisory

Proof of Concept (1)

—
https://github.com/mcpmark-eval-liuhezi/audit-cve-2020-8203
nomi-sec

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS — Exploitation Probability

5.21%
Raw Score 0.052130
Percentile 92.5%
Date 2026-11-05

EPSS Trend

2026-11-05
0.05213
2026-11-04
0.05213
2026-11-03
0.05213
2026-11-02
0.05213

Intelligence Sources

mitre ref →
nvd ref →

External Links