CVE-2021-23450

Katalog CVE

CVSS 9.8 · Critical EPSS 30,4%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada linuxfoundation dojo, oracle communications policy management +3 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

Rincian

Terbit di NVD

17 Desember 2021

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

30,4% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036 exploit · mitigasi · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 exploit · mitigasi · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034 exploit · mitigasi · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033 exploit · mitigasi · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-DOJO-1535223 exploit · mitigasi · advisory pihak ketiga
• https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172 broken link · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html mailing list · advisory pihak ketiga