CVE-2021-23450

🟡 Monitoruj

Zanieczyszczenie prototypu w pakiecie dojo umożliwia manipulację obiektami.

CVSS

7.5

EPSS

30.4%

Exploit

poc

Vendor

oracle

Opis źródłowy (NVD)

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

exploit Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	7.5
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	30.4%
Opublikowano (NVD)	2021-12-17 20:15:08 UTC
Ostatnia modyfikacja (NVD)	2026-10-08 22:17:08 UTC

Referencje

https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172 ([email protected]) [Broken Link, Third Party Advisory]
https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html ([email protected]) [Mailing List, Third Party Advisory]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036 ([email protected]) [Exploit, Mitigation, Third Party Advisory]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 ([email protected]) [Exploit, Mitigation, Third Party Advisory]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034 ([email protected]) [Exploit, Mitigation, Third Party Advisory]
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033 ([email protected]) [Exploit, Mitigation, Third Party Advisory]
https://snyk.io/vuln/SNYK-JS-DOJO-1535223 ([email protected]) [Exploit, Mitigation, Third Party Advisory]
https://www.oracle.com/security-alerts/cpuapr2022.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujul2022.html ([email protected]) [Patch, Third Party Advisory]