Lucene search

GitHub Advisory DatabaseGHSA-JV35-XQG7-F92R

HistoryJun 21, 2021 - 5:16 p.m.

set-getter Prototype Pollution Vulnerability

2021-06-2117:16:09

CWE-915

CWE-1321

GitHub Advisory Database

github.com

prototype pollution

denial of service

remote code execution

software

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

79.8%

JSON

Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Affected configurations

Vulners

Node

setgetterRange<0.1.1

VendorProductVersionCPE
setgetter*cpe:2.3:a:set:getter:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
set	getter	*	cpe:2.3:a:set:getter::::::::

References

github.com/advisories/GHSA-jv35-xqg7-f92r

github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be187744111378d/index.js#L56

github.com/doowb/set-getter/commit/66eb3f0d4686a4a8c7c3d6f7ecd8e570b580edc4

nvd.nist.gov/vuln/detail/CVE-2021-25949

web.archive.org/web/20210615022308/https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25949

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

79.8%

JSON

Related for GHSA-JV35-XQG7-F92R