CVE-2021-23434

Katalog CVE

CVSS 8.6 · High EPSS 1,9%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada object-path project object-path, debian linux. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Rincian

Terbit di NVD

27 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html mailing list · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453 exploit · advisory pihak ketiga
• https://github.com/mariocasciaro/object-path%230116 broken link