{"id":"CVE-2021-23434","published":"2021-08-27T16:50:13Z","modified":"2024-09-16T16:48:40Z","title":"Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01902,"percentile":0.79691,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453","tags":[]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423","tags":[]},{"url":"https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb","tags":[]},{"url":"https://github.com/mariocasciaro/object-path%230116","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html","tags":["mailing-list"]}],"priority":{"score":19.9,"factors":[{"name":"EPSS percentile","points":15.94},{"name":"CVSS severity","points":3.92}]},"affectedVersions":[{"vendor":"n/a","product":"object-path","versions":[">= unspecified, < 0.11.6"]}],"affected":[{"ecosystem":"npm","package":"object-path","vulnerableRanges":["<0.11.6"],"patched":["0.11.6"],"from":["GHSA-v39p-96qg-c8rf"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2112","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-mariocasciaro-object-path-cve-2020-15256","parents":[{"from":"CVE-2020-15256","to":"CVE-2021-23434","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays.","from":"CVE.org","in":"CVE-2021-23434"},{"kind":"version-step","provenance":"source","package":"npm:object-path","fromFixed":"0.11.5","toFixed":"0.11.6","daysApart":312}]}],"packageHistory":[{"cve":"CVE-2020-15256","published":"2020-10-19","fixed":"0.11.5","kev":false},{"cve":"CVE-2021-23434","published":"2021-08-27","fixed":"0.11.6","kev":false},{"cve":"CVE-2021-3805","published":"2021-09-17","fixed":"0.11.8","kev":false,"link":{"from":"CVE-2021-23434","to":"CVE-2021-3805","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:object-path","fromFixed":"0.11.6","toFixed":"0.11.8","daysApart":21}]}}],"package":"npm:object-path"}}