Common Weakness Enumeration
CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
779 vulnerabilities reference this CWE, most recent first.
CVE-2022-3901 (GCVE-0-2022-3901)
Vulnerability from cvelistv5 – Published: 2023-02-20 18:07 – Updated: 2025-04-01 04:48
VLAI
EPSS
VEX
Title
Visioweb.js - Prototype Pollution can results in XSS
Summary
Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://csirt.divd.nl/CVE-2022-3901 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Visio Globe | Visioweb |
Affected:
0 , ≤ 1.10.6
(1.10.6)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:20:58.640Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://csirt.divd.nl/CVE-2022-3901"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-3901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-12T18:09:19.196616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-12T18:09:24.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"product": "Visioweb",
"vendor": "Visio Globe",
"versions": [
{
"lessThanOrEqual": "1.10.6",
"status": "affected",
"version": "0",
"versionType": "1.10.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Jan-Jaap Korpershoek"
},
{
"lang": "en",
"type": "analyst",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Victor Pasman (DIVD)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system."
}
],
"value": "Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system."
}
],
"impacts": [
{
"capecId": "CAPEC-588",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-588 DOM-Based XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-01T04:48:08.974Z",
"orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"shortName": "DIVD"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://csirt.divd.nl/CVE-2022-3901"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Visioweb 1.10.7"
}
],
"value": "Upgrade to Visioweb 1.10.7"
}
],
"title": "Visioweb.js - Prototype Pollution can results in XSS",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
"assignerShortName": "DIVD",
"cveId": "CVE-2022-3901",
"datePublished": "2023-02-20T18:07:34.082Z",
"dateReserved": "2022-11-08T20:46:53.390Z",
"dateUpdated": "2025-04-01T04:48:08.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2564 (GCVE-0-2022-2564)
Vulnerability from cvelistv5 – Published: 2022-07-28 15:21 – Updated: 2024-11-20 16:14
VLAI
EPSS
VEX
Title
Prototype Pollution in automattic/mongoose
Summary
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Automattic/mongoose/blob/51e75… | x_refsource_MISC |
| https://huntr.dev/bounties/055be524-9296-4b2f-b68… | x_refsource_CONFIRM |
| https://github.com/automattic/mongoose/commit/a45… | x_refsource_MISC |
| https://github.com/Automattic/mongoose/compare/6.… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| automattic | automattic/mongoose |
Affected:
unspecified , < 6.4.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:39:08.061Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-2564",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T16:14:31.845118Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-20T16:14:46.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "automattic/mongoose",
"vendor": "automattic",
"versions": [
{
"lessThan": "6.4.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-14T17:52:17.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6"
}
],
"source": {
"advisory": "055be524-9296-4b2f-b68d-6d5b810d1ddd",
"discovery": "EXTERNAL"
},
"title": "Prototype Pollution in automattic/mongoose",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-2564",
"STATE": "PUBLIC",
"TITLE": "Prototype Pollution in automattic/mongoose"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "automattic/mongoose",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "6.4.6"
}
]
}
}
]
},
"vendor_name": "automattic"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141",
"refsource": "MISC",
"url": "https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141"
},
{
"name": "https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/055be524-9296-4b2f-b68d-6d5b810d1ddd"
},
{
"name": "https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8",
"refsource": "MISC",
"url": "https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8"
},
{
"name": "https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6",
"refsource": "MISC",
"url": "https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6"
}
]
},
"source": {
"advisory": "055be524-9296-4b2f-b68d-6d5b810d1ddd",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-2564",
"datePublished": "2022-07-28T15:21:20.000Z",
"dateReserved": "2022-07-28T00:00:00.000Z",
"dateUpdated": "2024-11-20T16:14:46.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1295 (GCVE-0-2022-1295)
Vulnerability from cvelistv5 – Published: 2022-04-11 11:20 – Updated: 2024-08-02 23:55
VLAI
EPSS
VEX
Title
Prototype Pollution in alvarotrigo/fullpage.js
Summary
Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
Severity
7.3 (High)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/3b9d450c-24ac-4037-b04… | x_refsource_CONFIRM |
| https://github.com/alvarotrigo/fullpage.js/commit… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| alvarotrigo | alvarotrigo/fullpage.js |
Affected:
unspecified , < 4.0.2
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:55:24.630Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "alvarotrigo/fullpage.js",
"vendor": "alvarotrigo",
"versions": [
{
"lessThan": "4.0.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-11T11:20:12.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48"
}
],
"source": {
"advisory": "3b9d450c-24ac-4037-b04d-4d4dafbf593a",
"discovery": "EXTERNAL"
},
"title": "Prototype Pollution in alvarotrigo/fullpage.js",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-1295",
"STATE": "PUBLIC",
"TITLE": "Prototype Pollution in alvarotrigo/fullpage.js"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "alvarotrigo/fullpage.js",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.0.2"
}
]
}
}
]
},
"vendor_name": "alvarotrigo"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a"
},
{
"name": "https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48",
"refsource": "MISC",
"url": "https://github.com/alvarotrigo/fullpage.js/commit/bf62492a22e5d296e63c3ed918a42fc5645a0d48"
}
]
},
"source": {
"advisory": "3b9d450c-24ac-4037-b04d-4d4dafbf593a",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-1295",
"datePublished": "2022-04-11T11:20:13.000Z",
"dateReserved": "2022-04-11T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:55:24.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-0432 (GCVE-0-2022-0432)
Vulnerability from cvelistv5 – Published: 2022-02-02 20:11 – Updated: 2024-08-02 23:25
VLAI
EPSS
VEX
Title
Prototype Pollution in mastodon/mastodon
Summary
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
Severity
7.4 (High)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://huntr.dev/bounties/d06da292-7716-4d74-a12… | x_refsource_CONFIRM |
| https://github.com/mastodon/mastodon/commit/4d6d4… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mastodon | mastodon/mastodon |
Affected:
unspecified , < 3.5.0
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:25:40.426Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mastodon/mastodon",
"vendor": "mastodon",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-02T20:11:08.000Z",
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntrdev"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09"
}
],
"source": {
"advisory": "d06da292-7716-4d74-a129-dd04773398d7",
"discovery": "EXTERNAL"
},
"title": "Prototype Pollution in mastodon/mastodon",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@huntr.dev",
"ID": "CVE-2022-0432",
"STATE": "PUBLIC",
"TITLE": "Prototype Pollution in mastodon/mastodon"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mastodon/mastodon",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "3.5.0"
}
]
}
}
]
},
"vendor_name": "mastodon"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7",
"refsource": "CONFIRM",
"url": "https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7"
},
{
"name": "https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09",
"refsource": "MISC",
"url": "https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09"
}
]
},
"source": {
"advisory": "d06da292-7716-4d74-a129-dd04773398d7",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntrdev",
"cveId": "CVE-2022-0432",
"datePublished": "2022-02-02T20:11:08.000Z",
"dateReserved": "2022-01-31T00:00:00.000Z",
"dateUpdated": "2024-08-02T23:25:40.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43787 (GCVE-0-2021-43787)
Vulnerability from cvelistv5 – Published: 2021-11-29 19:30 – Updated: 2024-08-04 04:03
VLAI
EPSS
VEX
Title
XSS via prototype pollution
Summary
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
Severity
9 (Critical)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/NodeBB/NodeBB/security/advisor… | x_refsource_CONFIRM |
| https://github.com/NodeBB/NodeBB/commit/1783f918b… | x_refsource_MISC |
| https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5 | x_refsource_MISC |
| https://blog.sonarsource.com/nodebb-remote-code-e… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:03:08.858Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fc"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4c"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "NodeBB",
"vendor": "NodeBB",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.15.5, \u003c 1.18.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-13T18:00:35.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fc"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4c"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/"
}
],
"source": {
"advisory": "GHSA-wx69-rvg3-x7fc",
"discovery": "UNKNOWN"
},
"title": "XSS via prototype pollution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-43787",
"STATE": "PUBLIC",
"TITLE": "XSS via prototype pollution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NodeBB",
"version": {
"version_data": [
{
"version_value": "\u003e= 1.15.5, \u003c 1.18.5"
}
]
}
}
]
},
"vendor_name": "NodeBB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fc",
"refsource": "CONFIRM",
"url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fc"
},
{
"name": "https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4c",
"refsource": "MISC",
"url": "https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4c"
},
{
"name": "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5",
"refsource": "MISC",
"url": "https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5"
},
{
"name": "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/",
"refsource": "MISC",
"url": "https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/"
}
]
},
"source": {
"advisory": "GHSA-wx69-rvg3-x7fc",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-43787",
"datePublished": "2021-11-29T19:30:11.000Z",
"dateReserved": "2021-11-16T00:00:00.000Z",
"dateUpdated": "2024-08-04T04:03:08.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-41097 (GCVE-0-2021-41097)
Vulnerability from cvelistv5 – Published: 2021-09-27 17:40 – Updated: 2024-08-04 02:59
VLAI
EPSS
VEX
Title
Prototype pollution in aurelia-path
Summary
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.
Severity
9.1 (Critical)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/aurelia/path/security/advisori… | x_refsource_CONFIRM |
| https://github.com/aurelia/path/issues/44 | x_refsource_MISC |
| https://github.com/aurelia/path/commit/7c4e235433… | x_refsource_MISC |
| https://github.com/aurelia/path/releases/tag/1.1.7 | x_refsource_MISC |
| https://www.npmjs.com/package/aurelia-path | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:59:31.515Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/aurelia/path/issues/44"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/aurelia/path/releases/tag/1.1.7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.npmjs.com/package/aurelia-path"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "path",
"vendor": "aurelia",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-27T17:40:12.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aurelia/path/issues/44"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aurelia/path/releases/tag/1.1.7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.npmjs.com/package/aurelia-path"
}
],
"source": {
"advisory": "GHSA-3c9c-2p65-qvwv",
"discovery": "UNKNOWN"
},
"title": "Prototype pollution in aurelia-path",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-41097",
"STATE": "PUBLIC",
"TITLE": "Prototype pollution in aurelia-path"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "path",
"version": {
"version_data": [
{
"version_value": "\u003c 1.1.7"
}
]
}
}
]
},
"vendor_name": "aurelia"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv",
"refsource": "CONFIRM",
"url": "https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv"
},
{
"name": "https://github.com/aurelia/path/issues/44",
"refsource": "MISC",
"url": "https://github.com/aurelia/path/issues/44"
},
{
"name": "https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1",
"refsource": "MISC",
"url": "https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1"
},
{
"name": "https://github.com/aurelia/path/releases/tag/1.1.7",
"refsource": "MISC",
"url": "https://github.com/aurelia/path/releases/tag/1.1.7"
},
{
"name": "https://www.npmjs.com/package/aurelia-path",
"refsource": "MISC",
"url": "https://www.npmjs.com/package/aurelia-path"
}
]
},
"source": {
"advisory": "GHSA-3c9c-2p65-qvwv",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-41097",
"datePublished": "2021-09-27T17:40:12.000Z",
"dateReserved": "2021-09-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T02:59:31.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39227 (GCVE-0-2021-39227)
Vulnerability from cvelistv5 – Published: 2021-09-17 14:10 – Updated: 2024-08-04 01:58
VLAI
EPSS
VEX
Title
Fix prototype pollution in the zrender merge and clone helper methods
Summary
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
Severity
6.2 (Medium)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ecomfe/zrender/security/adviso… | x_refsource_CONFIRM |
| https://github.com/ecomfe/zrender/pull/826 | x_refsource_MISC |
| https://github.com/ecomfe/zrender/releases/tag/5.2.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.239Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ecomfe/zrender/pull/826"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ecomfe/zrender/releases/tag/5.2.1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "zrender",
"vendor": "ecomfe",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-17T14:10:10.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ecomfe/zrender/pull/826"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ecomfe/zrender/releases/tag/5.2.1"
}
],
"source": {
"advisory": "GHSA-fhv8-fx5f-7fxf",
"discovery": "UNKNOWN"
},
"title": "Fix prototype pollution in the zrender merge and clone helper methods",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39227",
"STATE": "PUBLIC",
"TITLE": "Fix prototype pollution in the zrender merge and clone helper methods"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "zrender",
"version": {
"version_data": [
{
"version_value": "\u003c 5.2.1"
}
]
}
}
]
},
"vendor_name": "ecomfe"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf",
"refsource": "CONFIRM",
"url": "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf"
},
{
"name": "https://github.com/ecomfe/zrender/pull/826",
"refsource": "MISC",
"url": "https://github.com/ecomfe/zrender/pull/826"
},
{
"name": "https://github.com/ecomfe/zrender/releases/tag/5.2.1",
"refsource": "MISC",
"url": "https://github.com/ecomfe/zrender/releases/tag/5.2.1"
}
]
},
"source": {
"advisory": "GHSA-fhv8-fx5f-7fxf",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39227",
"datePublished": "2021-09-17T14:10:10.000Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:58:18.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39205 (GCVE-0-2021-39205)
Vulnerability from cvelistv5 – Published: 2021-09-15 17:15 – Updated: 2024-08-04 01:58
VLAI
EPSS
VEX
Title
DOM-based XSS/Content Spoofing via Prototype Pollution
Summary
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
Severity
6.8 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/jitsi/jitsi-meet/security/advi… | x_refsource_CONFIRM |
| https://github.com/jitsi/jitsi-meet/pull/9320 | x_refsource_MISC |
| https://github.com/jitsi/jitsi-meet/pull/9404 | x_refsource_MISC |
| https://hackerone.com/reports/1214493 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.6173
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.260Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.6173"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T17:15:12.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
},
"title": "DOM-based XSS/Content Spoofing via Prototype Pollution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39205",
"STATE": "PUBLIC",
"TITLE": "DOM-based XSS/Content Spoofing via Prototype Pollution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jitsi-meet",
"version": {
"version_data": [
{
"version_value": "\u003c 2.0.6173"
}
]
}
}
]
},
"vendor_name": "jitsi"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg",
"refsource": "CONFIRM",
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9320",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9404",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"name": "https://hackerone.com/reports/1214493",
"refsource": "MISC",
"url": "https://hackerone.com/reports/1214493"
}
]
},
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39205",
"datePublished": "2021-09-15T17:15:12.000Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-08-04T01:58:18.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-32736 (GCVE-0-2021-32736)
Vulnerability from cvelistv5 – Published: 2021-06-30 17:25 – Updated: 2024-08-03 23:33
VLAI
EPSS
VEX
Title
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper
Summary
think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3.
Severity
7.5 (High)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/thinkjs/think-helper/security/… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| thinkjs | think-helper |
Affected:
< 1.1.3
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "think-helper",
"vendor": "thinkjs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-30T17:25:09.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp"
}
],
"source": {
"advisory": "GHSA-vr5m-3h59-7jcp",
"discovery": "UNKNOWN"
},
"title": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) in think-helper",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32736",
"STATE": "PUBLIC",
"TITLE": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) in think-helper"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "think-helper",
"version": {
"version_data": [
{
"version_value": "\u003c 1.1.3"
}
]
}
}
]
},
"vendor_name": "thinkjs"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp",
"refsource": "CONFIRM",
"url": "https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp"
}
]
},
"source": {
"advisory": "GHSA-vr5m-3h59-7jcp",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32736",
"datePublished": "2021-06-30T17:25:09.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-21304 (GCVE-0-2021-21304)
Vulnerability from cvelistv5 – Published: 2021-02-08 17:40 – Updated: 2024-08-03 18:09
VLAI
EPSS
VEX
Title
Prototype Pollution in Dynamoose
Summary
Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability.
Severity
7.2 (High)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dynamoose/dynamoose/security/a… | x_refsource_CONFIRM |
| https://github.com/dynamoose/dynamoose/commit/324… | x_refsource_MISC |
| https://github.com/dynamoose/dynamoose/releases/t… | x_refsource_MISC |
| https://www.npmjs.com/package/dynamoose | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:09:15.762Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.npmjs.com/package/dynamoose"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "dynamoose",
"vendor": "dynamoose",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dynamoose is an open-source modeling tool for Amazon\u0027s DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method \"lib/utils/object/set.ts\". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-08T17:40:17.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.npmjs.com/package/dynamoose"
}
],
"source": {
"advisory": "GHSA-rrqm-p222-8ph2",
"discovery": "UNKNOWN"
},
"title": "Prototype Pollution in Dynamoose",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21304",
"STATE": "PUBLIC",
"TITLE": "Prototype Pollution in Dynamoose"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "dynamoose",
"version": {
"version_data": [
{
"version_value": "\u003e= 2.0.0, \u003c 2.7.0"
}
]
}
}
]
},
"vendor_name": "dynamoose"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dynamoose is an open-source modeling tool for Amazon\u0027s DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method \"lib/utils/object/set.ts\". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2",
"refsource": "CONFIRM",
"url": "https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2"
},
{
"name": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e",
"refsource": "MISC",
"url": "https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e"
},
{
"name": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0",
"refsource": "MISC",
"url": "https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0"
},
{
"name": "https://www.npmjs.com/package/dynamoose",
"refsource": "MISC",
"url": "https://www.npmjs.com/package/dynamoose"
}
]
},
"source": {
"advisory": "GHSA-rrqm-p222-8ph2",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-21304",
"datePublished": "2021-02-08T17:40:17.000Z",
"dateReserved": "2020-12-22T00:00:00.000Z",
"dateUpdated": "2024-08-03T18:09:15.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Implementation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.