CVE-2021-3805 — Prototype Pollution in Object-path

CWE-1321 — Prototype PollutionCWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes8 documents6 sources
Severity
7.5HIGHNVD
OSV9.8
EPSS
0.7%
top 29.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mariocasciaro Object-pathObject-path Project Object-pathDebian Node-object-path+1 more
Timeline
PublishedSep 17
Latest updateMar 22

Description

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/node-object-path< node-object-path 0.11.8-1 (bookworm)
▶CVEListV5mariocasciaro/mariocasciaro_object-pathunspecified — 0.11.8

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: huntr.dev ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
node-object-path vulnerabilities↗2023-03-22
▶
OSV
Prototype Pollution in object-path↗2021-09-20
▶
GHSA
Prototype Pollution in object-path↗2021-09-20
▶
OSV
CVE-2021-3805: object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')↗2021-09-17
▶

📋Vendor Advisories

3
Ubuntu
object-path vulnerabilities↗2023-03-22
▶
Red Hat
nodejs-object-path: prototype pollution vulnerability↗2021-09-13
▶
Debian
CVE-2021-3805: node-object-path - object-path is vulnerable to Improperly Controlled Modification of Object Protot...↗2021
▶