PT-2023-12411 · Unknown · Yomguithereal Baobab

Yomguithereal · Publicado 2023-01-07 · Atualizado 2024-05-17 · CVE-2021-4307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yomguithereal Baobab versions up to 2.6.0

Description A critical issue affects an unknown functionality, leading to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. This can be exploited remotely.

Recommendations To address this issue, upgrade to version 2.6.1. As a temporary workaround, consider restricting access to components that may be affected by the 'prototype pollution' issue until the patch is applied.

Exploit

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2021-4307

GHSA-WVR2-Q86M-6WHP

Produtos afetados

Yomguithereal Baobab

Referências · 13

• 🔥 https://github.com/Yomguithereal/baobab/pull/511 · Exploit
• https://github.com/Yomguithereal/baobab/releases/tag/2.6.1 · Correção
• https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19 · Correção
• https://github.com/Yomguithereal/baobab · Nota
• https://t.me/cvenotify/41875 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-4307 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wvr2-q86m-6whp · Aviso do Fabricante
• https://vuldb.com/?ctiid.217627 · Nota
• https://osv.dev/vulnerability/CVE-2021-4307 · Aviso do Fabricante
• https://t.me/cibsecurity/56127 · Publicação no Telegram
• https://t.me/cvenotify/41501 · Publicação no Telegram
• https://vuldb.com/?id.217627 · Nota
• https://t.me/cvenotify/62856 · Publicação no Telegram