CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
783 vulnerabilities reference this CWE, most recent first.
GHSA-FG52-5JJJ-28H7
Vulnerability from github – Published: 2024-06-17 15:30 – Updated: 2024-06-17 21:29A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@cdr0/sg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36580"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:29:55Z",
"nvd_published_at": "2024-06-17T14:15:10Z",
"severity": "MODERATE"
},
"details": "A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.",
"id": "GHSA-fg52-5jjj-28h7",
"modified": "2024-06-17T21:29:55Z",
"published": "2024-06-17T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36580"
},
{
"type": "WEB",
"url": "https://github.com/briancsparks/cdr0-sg/issues/11"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/a75d75eca4622ad08f7cfa903a6cc9c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/briancsparks/cdr0-sg"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "@cdr0/sg Prototype Pollution"
}
GHSA-FGQ5-VX4R-RG7C
Vulnerability from github – Published: 2024-07-30 21:31 – Updated: 2024-08-01 15:32Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)
{
"affected": [],
"aliases": [
"CVE-2024-38983"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T21:15:09Z",
"severity": "CRITICAL"
},
"details": "Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91)",
"id": "GHSA-fgq5-vx4r-rg7c",
"modified": "2024-08-01T15:32:15Z",
"published": "2024-07-30T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38983"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/f82d0c3a8fe3a125f06425caef5d22ed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHV8-FX5F-7FXF
Vulnerability from github – Published: 2021-09-20 19:53 – Updated: 2024-12-06 18:20Impact
Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.
Patches
It has been patched in https://github.com/ecomfe/zrender/pull/826.
Users should update zrender to 5.2.1. and update echarts to 5.2.1 if project is using echarts.
References
NA
For more information
NA
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "zrender"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.3.2"
},
"package": {
"ecosystem": "npm",
"name": "zrender"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39227"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-17T17:51:46Z",
"nvd_published_at": "2021-09-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nUsing `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.\n\n### Patches\n \nIt has been patched in https://github.com/ecomfe/zrender/pull/826. \nUsers should update zrender to `5.2.1`. and update echarts to `5.2.1` if project is using echarts.\n\n### References\nNA\n\n### For more information\nNA\n",
"id": "GHSA-fhv8-fx5f-7fxf",
"modified": "2024-12-06T18:20:49Z",
"published": "2021-09-20T19:53:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39227"
},
{
"type": "WEB",
"url": "https://github.com/ecomfe/zrender/pull/826"
},
{
"type": "PACKAGE",
"url": "https://github.com/ecomfe/zrender"
},
{
"type": "WEB",
"url": "https://github.com/ecomfe/zrender/releases/tag/5.2.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in the merge and clone helper methods"
}
GHSA-FM93-FHH2-CG2C
Vulnerability from github – Published: 2022-01-27 14:21 – Updated: 2025-07-18 19:44Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references.
Original Description
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "min-dash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-24T22:51:52Z",
"nvd_published_at": "2022-01-21T20:15:00Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references.\n\n## Original Description\nThe package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.",
"id": "GHSA-fm93-fhh2-cg2c",
"modified": "2025-07-18T19:44:32Z",
"published": "2022-01-27T14:21:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23460"
},
{
"type": "WEB",
"url": "https://github.com/bpmn-io/min-dash/pull/21"
},
{
"type": "WEB",
"url": "https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320"
},
{
"type": "PACKAGE",
"url": "https://github.com/bpmn-io/min-dash"
},
{
"type": "WEB",
"url": "https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-MINDASH-2340605"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Prototype Pollution in min-dash",
"withdrawn": "2025-07-18T19:44:32Z"
}
GHSA-FMRR-MX6J-H3H5
Vulnerability from github – Published: 2021-05-06 18:12 – Updated: 2021-05-05 18:50All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "confucious"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7714"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-05T18:50:23Z",
"nvd_published_at": "2020-09-01T10:15:00Z",
"severity": "CRITICAL"
},
"details": "All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function.",
"id": "GHSA-fmrr-mx6j-h3h5",
"modified": "2021-05-05T18:50:23Z",
"published": "2021-05-06T18:12:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7714"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-CONFUCIOUS-598665"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in confucious"
}
GHSA-FP82-2H99-3FPP
Vulnerability from github – Published: 2018-09-18 13:47 – Updated: 2022-04-26 20:44The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "merge-object"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3753"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:35:00Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.",
"id": "GHSA-fp82-2h99-3fpp",
"modified": "2022-04-26T20:44:24Z",
"published": "2018-09-18T13:47:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3753"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/310706"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in async merge-object"
}
GHSA-FQG8-VFV7-8FJ8
Vulnerability from github – Published: 2024-03-04 20:43 – Updated: 2024-03-06 21:36Impact
In JSONata versions >= 1.4.0, < 1.8.7 and >= 2.0.0, < 2.0.4, a malicious expression can use the transform operator to override properties on the Object constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions.
Patch
This issue has been fixed in JSONata versions >= 1.8.7 and >= 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible.
--- a/src/jsonata.js
+++ b/src/jsonata.js
@@ -1293,6 +1293,13 @@ var jsonata = (function() {
}
for(var ii = 0; ii < matches.length; ii++) {
var match = matches[ii];
+ if (match && (match.isPrototypeOf(result) || match instanceof Object.constructor)) {
+ throw {
+ code: "D1010",
+ stack: (new Error()).stack,
+ position: expr.position
+ };
+ }
// evaluate the update value for each match
var update = await evaluate(expr.update, match, environment);
// update must be an object
@@ -1539,7 +1546,7 @@ var jsonata = (function() {
if (typeof err.token == 'undefined' && typeof proc.token !== 'undefined') {
err.token = proc.token;
}
- err.position = proc.position;
+ err.position = proc.position || err.position;
}
throw err;
}
@@ -1972,6 +1979,7 @@ var jsonata = (function() {
"T1007": "Attempted to partially apply a non-function. Did you mean ${{{token}}}?",
"T1008": "Attempted to partially apply a non-function",
"D1009": "Multiple key definitions evaluate to same key: {{value}}",
+ "D1010": "Attempted to access the Javascript object prototype", // Javascript specific
"T1010": "The matcher function argument passed to function {{token}} does not return the correct object structure",
"T2001": "The left side of the {{token}} operator must evaluate to a number",
"T2002": "The right side of the {{token}} operator must evaluate to a number",
References
https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4
Credit
Thank you to Albert Pedersen of Cloudflare for disclosing this issue.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsonata"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.8.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "jsonata"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27307"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-04T20:43:12Z",
"nvd_published_at": "2024-03-06T20:15:47Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nIn JSONata versions `\u003e= 1.4.0, \u003c 1.8.7` and `\u003e= 2.0.0, \u003c 2.0.4`, a malicious expression can use the [transform operator](https://docs.jsonata.org/other-operators#-------transform) to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions.\n\n### Patch\n\nThis issue has been fixed in JSONata versions `\u003e= 1.8.7` and `\u003e= 2.0.4`. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. The following patch can be applied if updating is not possible.\n\n```patch\n--- a/src/jsonata.js\n+++ b/src/jsonata.js\n@@ -1293,6 +1293,13 @@ var jsonata = (function() {\n }\n for(var ii = 0; ii \u003c matches.length; ii++) {\n var match = matches[ii];\n+ if (match \u0026\u0026 (match.isPrototypeOf(result) || match instanceof Object.constructor)) {\n+ throw {\n+ code: \"D1010\",\n+ stack: (new Error()).stack,\n+ position: expr.position\n+ };\n+ }\n // evaluate the update value for each match\n var update = await evaluate(expr.update, match, environment);\n // update must be an object\n@@ -1539,7 +1546,7 @@ var jsonata = (function() {\n if (typeof err.token == \u0027undefined\u0027 \u0026\u0026 typeof proc.token !== \u0027undefined\u0027) {\n err.token = proc.token;\n }\n- err.position = proc.position;\n+ err.position = proc.position || err.position;\n }\n throw err;\n }\n@@ -1972,6 +1979,7 @@ var jsonata = (function() {\n \"T1007\": \"Attempted to partially apply a non-function. Did you mean ${{{token}}}?\",\n \"T1008\": \"Attempted to partially apply a non-function\",\n \"D1009\": \"Multiple key definitions evaluate to same key: {{value}}\",\n+ \"D1010\": \"Attempted to access the Javascript object prototype\", // Javascript specific \n \"T1010\": \"The matcher function argument passed to function {{token}} does not return the correct object structure\",\n \"T2001\": \"The left side of the {{token}} operator must evaluate to a number\",\n \"T2002\": \"The right side of the {{token}} operator must evaluate to a number\",\n```\n\n### References\n\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.0.4\n\n### Credit\n\nThank you to Albert Pedersen of Cloudflare for disclosing this issue.\n",
"id": "GHSA-fqg8-vfv7-8fj8",
"modified": "2024-03-06T21:36:55Z",
"published": "2024-03-04T20:43:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-fqg8-vfv7-8fj8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27307"
},
{
"type": "WEB",
"url": "https://github.com/jsonata-js/jsonata/commit/1d579dbe99c19fbe509f5ba2c6db7959b0d456d1"
},
{
"type": "WEB",
"url": "https://github.com/jsonata-js/jsonata/commit/335d38f6278e96c908b24183f1c9c90afc8ae00c"
},
{
"type": "WEB",
"url": "https://github.com/jsonata-js/jsonata/commit/c907b5e517bb718015fcbd993d742ba6202f2be2"
},
{
"type": "PACKAGE",
"url": "https://github.com/jsonata-js/jsonata"
},
{
"type": "WEB",
"url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.0.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "JSONata expression can pollute the \"Object\" prototype"
}
GHSA-FQQ9-F3PW-4CFF
Vulnerability from github – Published: 2022-02-03 00:00 – Updated: 2022-02-06 00:01Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
{
"affected": [],
"aliases": [
"CVE-2022-0432"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-02T22:15:00Z",
"severity": "MODERATE"
},
"details": "Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.",
"id": "GHSA-fqq9-f3pw-4cff",
"modified": "2022-02-06T00:01:08Z",
"published": "2022-02-03T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0432"
},
{
"type": "WEB",
"url": "https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FVQR-27WR-82FM
Vulnerability from github – Published: 2018-07-26 15:14 – Updated: 2025-08-12 21:37Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.5 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "lodash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.17.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "lodash-rails"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.17.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3721"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-471"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:35:26Z",
"nvd_published_at": "2018-06-07T02:29:08Z",
"severity": "MODERATE"
},
"details": "Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. \n\nThe vulnerable functions are \u0027defaultsDeep\u0027, \u0027merge\u0027, and \u0027mergeWith\u0027 which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.17.5 or later.",
"id": "GHSA-fvqr-27wr-82fm",
"modified": "2025-08-12T21:37:06Z",
"published": "2018-07-26T15:14:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3721"
},
{
"type": "WEB",
"url": "https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/310443"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190919-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in lodash"
}
GHSA-FW45-938V-P26J
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2024-04-22 23:15Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mootools-more"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-20088"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:15:04Z",
"nvd_published_at": "2021-04-23T18:15:00Z",
"severity": "HIGH"
},
"details": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.",
"id": "GHSA-fw45-938v-p26j",
"modified": "2024-04-22T23:15:04Z",
"published": "2022-05-24T22:01:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20088"
},
{
"type": "WEB",
"url": "https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/mootools/mootools-more"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "mootools-more vulnerable to prototype pollution"
}
Mitigation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.