CVE-2021-23566

Katalog CVE

CVSS 5.5 · Medium EPSS 0,44%

Kerentanan Incorrect Type Conversion or Cast pada nanoid project nanoid. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Rincian

Terbit di NVD

14 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575 patch · advisory pihak ketiga
• https://github.com/ai/nanoid/pull/328 exploit · issue tracking · patch · advisory pihak ketiga
• https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-NANOID-2332193 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
• https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html