PT-2021-15514 · Proto · Proto

Vanshal Gaur · Published 2021-09-01 · Updated 2021-09-09 · CVE-2021-23426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Proto (affected versions not specified)

Description The issue allows an attacker to inject and pollute the object property of an application using Proto by leveraging the merge function. This can potentially lead to unintended behavior or security breaches in applications that utilize the Proto package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23426

GHSA-58G2-9FQR-36Q2

Affected Products

Proto

References · 6

• 🔥 https://snyk.io/vuln/SNYK-JS-PROTO-1316301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-23426 · Security Note
• https://osv.dev/vulnerability/GHSA-58g2-9fqr-36q2 · Vendor Advisory
• https://github.com/adriancmiranda/Proto · Note
• https://t.me/cibsecurity/28176 · Telegram Post
• https://npmjs.com/package/Proto · Note