CVE-2021-23624 Prototype Pollution

2021-11-0317:20:16

snyk

www.cve.org

type confusion

bypass

dotty

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:C

AI Score

9.7

Confidence

High

EPSS

0.012

Percentile

85.1%

JSON

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.

CNA Affected

[
  {
    "product": "dotty",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.1.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]