PT-2021-13766 · Unknown · Mootools-More

Published 2021-04-23 · Updated 2023-08-08 · CVE-2021-20088

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mootools-more version 1.6.0

Description: The issue is related to 'Prototype Pollution' where a malicious user can inject properties into Object.prototype due to improperly controlled modification of object prototype attributes.

Recommendations: For mootools-more version 1.6.0, update to a version that fixes the 'Prototype Pollution' issue to prevent malicious users from injecting properties into Object.prototype.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-20088

GHSA-FW45-938V-P26J

Affected Products

Mootools-More

References · 5

• 🔥 https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/mootools-more.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20088 · Security Note
• https://osv.dev/vulnerability/GHSA-fw45-938v-p26j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20088 · Vendor Advisory
• https://github.com/mootools/mootools-more · Note