Search/CVE-2020-8203
● CVE — High

CVE-2020-8203

Vendorlodash, oracleProductlodash, peoplesoft enterprise peopletools, jd edwards enterpriseone tools, communications session border controller, enterprise communications broker, communications billing and revenue management, primavera gateway, banking corporate lending process management, banking credit facilities process management, banking supply chain finance, banking trade finance process management, banking virtual account management, banking extensibility workbench, blockchain platform, communications cloud native core policy, banking liquidity management, communications session router, communications subscriber-aware load balancerDiscoveredJul 15, 2020UpdatedNov 2, 2026

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

CVSS v3.1
7.4 HIGH
EPSS
5.21%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Connections
21 relationships
Timeline
disclosure → media coverage
Jul 15, 2020
Disclosure — published as a CVE record. · last revised by NVD Nov 2, 2026
Jun 9, 2026
ubuntu.com reports: USN-8411-1: Lodash vulnerabilities
Public PoC (1)
Unverified third-party code — review before executing.