Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-V39P-96QG-C8RF
HistorySep 01, 2021 - 6:37 p.m.

Prototype Pollution in object-path

2021-09-0118:37:11
CWE-843
CWE-1321
GitHub Advisory Database
github.com
22

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

71.8%

JSON

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Affected configurations

Vulners
Node
objectpathRange<0.11.6
CPENameOperatorVersion
object-pathlt0.11.6

Related

redhatcve 2
ubuntucve 2
osv 6
nvd 2
cve 2
prion 2
nessus 3
debiancve 2
cvelist 2
ubuntu 1
debian 1
openvas 2
cnvd 1
githubexploit 1
veracode 2
ibm 3
huntr 1
github 1
nodejs 1
redhat 3
redhatcve
redhatcve
CVE-2021-23434
2021-08-31 18:49:33
CVE-2020-15256
2020-11-27 14:51:36
ubuntucve
ubuntucve
CVE-2021-23434
2021-08-27 00:00:00
CVE-2020-15256
2020-10-19 00:00:00
osv
osv
CVE-2021-23434
2021-08-27 17:15:06
Prototype Pollution in object-path
2021-09-01 18:37:11
node-object-path vulnerabilities
2023-03-22 00:07:34
nvd
nvd
CVE-2021-23434
2021-08-27 17:15:06
CVE-2020-15256
2020-10-19 22:15:13
cve
cve
CVE-2021-23434
2021-08-27 17:15:06
CVE-2020-15256
2020-10-19 22:15:13
prion
prion
Type confusion
2021-08-27 17:15:00
Design/Logic Flaw
2020-10-19 22:15:00
nessus
nessus
RHEL 7 : io.enmasse-enmasse (Unpatched Vulnerability)
2024-06-03 00:00:00
Ubuntu 18.04 LTS / 20.04 LTS : object-path vulnerabilities (USN-5967-1)
2023-03-22 00:00:00
Debian DLA-3291-1 : node-object-path - LTS security update
2023-01-31 00:00:00
debiancve
debiancve
CVE-2021-23434
2021-08-27 17:15:06
CVE-2020-15256
2020-10-19 22:15:13
cvelist
cvelist
CVE-2021-23434 Prototype Pollution
2021-08-27 00:00:00
CVE-2020-15256 Prototype pollution in object-path
2020-10-19 21:25:13
ubuntu
ubuntu
object-path vulnerabilities
2023-03-22 00:00:00
debian
debian
[SECURITY] [DLA 3291-1] node-object-path security update
2023-01-29 16:18:03
openvas
openvas
Ubuntu: Security Advisory (USN-5967-1)
2023-03-23 00:00:00
Debian: Security Advisory (DLA-3291-1)
2023-01-30 00:00:00
cnvd
cnvd
Object-path has an unspecified vulnerability
2021-08-31 00:00:00
githubexploit
githubexploit
Exploit for CVE-2020-15256
2020-12-08 13:40:01
veracode
veracode
Prototype Pollution
2021-08-30 02:41:28
Prototype Pollution
2020-10-20 01:39:11
ibm
ibm
Security Bulletin: Version 0.11.4 of Node.js module object-path included in IBM Netcool Operations Insight 1.6.2.x has a security vulnerability
2020-12-15 18:41:35
Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System
2022-08-17 09:46:50
Security Bulletin: Cloud Pak for Security contains packages that have multiple vulnerabilities
2022-04-01 16:38:26
huntr
huntr
Prototype Pollution in mariocasciaro/object-path
2020-09-14 00:00:00
github
github
Prototype pollution in object-path
2020-10-19 20:55:55
nodejs
nodejs
Prototype Pollution
2020-10-19 21:18:04
redhat
redhat
(RHSA-2021:3873) Important: Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates
2021-10-14 19:47:17
(RHSA-2022:0856) Moderate: Red Hat Advanced Cluster Management 2.2.11 security updates and bug fixes
2022-03-14 12:22:55
(RHSA-2021:3925) Important: Red Hat Advanced Cluster Management 2.3.3 bug fix, security, and image updates
2021-10-19 23:47:29

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

71.8%

JSON
Related for GHSA-V39P-96QG-C8RF
redhatcve2ubuntucve2osv6nvd2cve2prion2nessus3debiancve2cvelist2ubuntu1debian1openvas2cnvd1githubexploit1veracode2ibm3huntr1github1nodejs1redhat3