CVE-2021-23438

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada mpath project mpath. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Rincian

Terbit di NVD

1 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-MPATH-1577289 exploit · advisory pihak ketiga