CVE-2021-21304

Katalog CVE

CVSS 9.8 · Critical EPSS 1,9%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada dynamoosejs dynamoose. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability.

Rincian

Terbit di NVD

8 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e patch · advisory pihak ketiga
• https://github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2 patch · advisory pihak ketiga
• https://github.com/dynamoose/dynamoose/releases/tag/v2.7.0 release notes · advisory pihak ketiga
• https://www.npmjs.com/package/dynamoose product · advisory pihak ketiga