CVE-2021-23440 Prototype Pollution

2021-09-1200:00:00

snyk

www.cve.org

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

9.5 High

AI Score

Confidence

High

0.064 Low

EPSS

Percentile

93.7%

JSON

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.

CNA Affected

[
  {
    "product": "set-value",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "<2.0.1"
      },
      {
        "status": "affected",
        "version": ">=3.0.0 <4.0.1"
      }
    ]
  }
]