CVE-2021-43138

Katalog CVE

CVSS 7.8 · High EPSS 3,3%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada async project async, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Rincian

Terbit di NVD

6 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d patch · advisory pihak ketiga
• https://github.com/caolan/async/compare/v2.6.3...v2.6.4 patch · advisory pihak ketiga
• https://github.com/caolan/async/pull/1828 patch · advisory pihak ketiga
• https://github.com/caolan/async/blob/master/lib/internal/iterator.js advisory pihak ketiga
• https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js advisory pihak ketiga
• https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264 release notes · advisory pihak ketiga
• https://jsfiddle.net/oz5twjd9/ exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGK...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5...
• https://security.netapp.com/advisory/ntap-20240621-0006/