PT-2021-15540 · Dotty · Dotty

Alessio Della Libera · Published 2021-11-03 · Updated 2021-11-08 · CVE-2021-23624

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dotty versions prior to 0.1.2

Description A type confusion issue can lead to a bypass when user-provided keys used in the path parameter are arrays.

Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the issue.

Exploit

Fix

Type Confusion

Prototype Pollution

Weakness Enumeration

CWE-843

CWE-1321

Related Identifiers

CVE-2021-23624

GHSA-6G47-63MV-QPGH

SNYK-JS-DOTTY-1577292

Affected Products

Dotty

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-DOTTY-1577292 · Exploit
• https://github.com/deoxxa/dotty/commit/88f61860dcc274a07a263c32cbe9d44c24ef02d7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23624 · Security Note
• https://osv.dev/vulnerability/GHSA-6g47-63mv-qpgh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23624 · Vendor Advisory
• https://github.com/deoxxa/dotty · Note
• https://t.me/cibsecurity/31755 · Telegram Post
• https://t.me/cvenotify/23056 · Telegram Post