Prototype Pollution
CVE-2021-23470

8.2HIGH

Key Information:

Vendor

Putil-merge Project

Status
Putil-merge
Vendor
CVE Published:
4 February 2022

What is CVE-2021-23470?

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

Affected Version(s)

putil-merge < 3.8.0

References

https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487
x_refsource_MISC
https://github.com/panates/putil-merge/commit/476d00078df...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cristian-Alexandru Staicu
Abdullah Alhamdan
.