CVE-2022-21213

Katalog CVE

CVSS 7.5 · High EPSS 2,1%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada moutjs mout. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).

Rincian

Terbit di NVD

17 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mout/mout/blob/master/src/object/deepFillIn.js exploit · advisory pihak ketiga
• https://github.com/mout/mout/blob/master/src/object/deepMixIn.js exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2870623 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2870622 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-MOUT-2342654 exploit · advisory pihak ketiga