CVE-2021-23509 Prototype Pollution

2021-11-0317:20:36

snyk

www.cve.org

cve-2021-23509

json-ptr

prototype pollution

vulnerability

type confusion

bypass

user-provided keys

pointer parameter

arrays

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

AI Score

9.7

Confidence

High

EPSS

0.199

Percentile

96.4%

JSON

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.

CNA Affected

[
  {
    "product": "json-ptr",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]