PT-2021-16843 · Unknown · Set-Or-Get

Arjunshibu · Published 2021-02-08 · Updated 2023-08-08 · CVE-2021-25913

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions set-or-get versions 1.0.0 through 1.2.10

Description The issue is a prototype pollution vulnerability that allows an attacker to cause a denial of service and may lead to remote code execution.

Recommendations For versions 1.0.0 through 1.2.10, update to a version later than 1.2.10 to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions and parameters that may be exploited through the prototype pollution vulnerability until a patch is available.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-25913

GHSA-6RV4-4QV6-88G2

Affected Products

Set-Or-Get

References · 8

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25913 · Exploit
• https://github.com/IonicaBizau/set-or-get.js/commit/82ede5cccb2e8d13e4f62599203a4389f6d8e936 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25913 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25913 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6rv4-4qv6-88g2 · Vendor Advisory
• https://npmjs.com/package/set-or-get · Note
• https://t.me/cibsecurity/23269 · Telegram Post
• https://t.me/cvenotify/10483 · Telegram Post