Vulnerabilites related to baidu - zrender
Vulnerability from fkie_nvd
Published
2021-09-17 14:15
Modified
2024-11-21 06:18
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security-advisories@github.com | https://github.com/ecomfe/zrender/pull/826 | Patch, Third Party Advisory | |
| security-advisories@github.com | https://github.com/ecomfe/zrender/releases/tag/5.2.1 | Release Notes, Third Party Advisory | |
| security-advisories@github.com | https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ecomfe/zrender/pull/826 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ecomfe/zrender/releases/tag/5.2.1 | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf | Third Party Advisory |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:baidu:zrender:*:*:*:*:*:*:*:*", matchCriteriaId: "845D4793-646B-450A-AAA7-53DA4E16BCED", versionEndExcluding: "5.2.1", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.", }, { lang: "es", value: "ZRender es una librería gráfica ligera que permite dibujar en 2D para Apache ECharts. En versiones anteriores a 5.2.1, el uso de los métodos de ayuda \"merge\" y \"clone\" en el módulo \"src/core/util.ts\" resulta en una contaminación de prototipo. Esto afecta a la popular biblioteca de visualización de datos Apache ECharts, que usa y exporta estos dos métodos directamente. La página de GitHub Security Advisory para esta vulnerabilidad contiene una prueba de concepto. Este problema está parcheado en la versión 5.2.1 de ZRender. Se presenta una solución disponible: Comprueba si presenta \"__proto__\" en las claves del objeto. Omitirlo antes de usarlo como parámetro en estos métodos afectados. O en \"echarts.util.merge\" y \"setOption\" si el proyecto esta usando ECharts", }, ], id: "CVE-2021-39227", lastModified: "2024-11-21T06:18:57.397", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, exploitabilityScore: 2.5, impactScore: 3.6, source: "security-advisories@github.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2021-09-17T14:15:08.353", references: [ { source: "security-advisories@github.com", tags: [ "Patch", "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/pull/826", }, { source: "security-advisories@github.com", tags: [ "Release Notes", "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", }, { source: "security-advisories@github.com", tags: [ "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/pull/826", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", }, ], sourceIdentifier: "security-advisories@github.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-1321", }, ], source: "security-advisories@github.com", type: "Secondary", }, { description: [ { lang: "en", value: "CWE-1321", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
cve-2021-39227
Vulnerability from cvelistv5
Published
2021-09-17 14:10
Modified
2024-08-04 01:58
Severity ?
EPSS score ?
Summary
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf | x_refsource_CONFIRM | |
| https://github.com/ecomfe/zrender/pull/826 | x_refsource_MISC | |
| https://github.com/ecomfe/zrender/releases/tag/5.2.1 | x_refsource_MISC |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T01:58:18.239Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/ecomfe/zrender/pull/826", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "zrender", vendor: "ecomfe", versions: [ { status: "affected", version: "< 5.2.1", }, ], }, ], descriptions: [ { lang: "en", value: "ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-1321", description: "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-09-17T14:10:10", orgId: "a0819718-46f1-4df5-94e2-005712e83aaa", shortName: "GitHub_M", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/ecomfe/zrender/pull/826", }, { tags: [ "x_refsource_MISC", ], url: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", }, ], source: { advisory: "GHSA-fhv8-fx5f-7fxf", discovery: "UNKNOWN", }, title: "Fix prototype pollution in the zrender merge and clone helper methods", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security-advisories@github.com", ID: "CVE-2021-39227", STATE: "PUBLIC", TITLE: "Fix prototype pollution in the zrender merge and clone helper methods", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "zrender", version: { version_data: [ { version_value: "< 5.2.1", }, ], }, }, ], }, vendor_name: "ecomfe", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization library Apache ECharts, which uses and exports these two methods directly. The GitHub Security Advisory page for this vulnerability contains a proof of concept. This issue is patched in ZRender version 5.2.1. One workaround is available: Check if there is `__proto__` in the object keys. Omit it before using it as an parameter in these affected methods. Or in `echarts.util.merge` and `setOption` if project is using ECharts.", }, ], }, impact: { cvss: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 6.2, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", }, ], }, ], }, references: { reference_data: [ { name: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", refsource: "CONFIRM", url: "https://github.com/ecomfe/zrender/security/advisories/GHSA-fhv8-fx5f-7fxf", }, { name: "https://github.com/ecomfe/zrender/pull/826", refsource: "MISC", url: "https://github.com/ecomfe/zrender/pull/826", }, { name: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", refsource: "MISC", url: "https://github.com/ecomfe/zrender/releases/tag/5.2.1", }, ], }, source: { advisory: "GHSA-fhv8-fx5f-7fxf", discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa", assignerShortName: "GitHub_M", cveId: "CVE-2021-39227", datePublished: "2021-09-17T14:10:10", dateReserved: "2021-08-16T00:00:00", dateUpdated: "2024-08-04T01:58:18.239Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }