PT-2021-19896 · Unknown · Think-Helper

Yoshino-S · Published 2021-06-30 · Updated 2022-07-22 · CVE-2021-32736

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions think-helper versions prior to 1.1.3

Description The software receives input from an upstream component that specifies attributes to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Recommendations For think-helper versions prior to 1.1.3, upgrade to version 1.1.3 or later to resolve the issue.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-32736

GHSA-VR5M-3H59-7JCP

Affected Products

Think-Helper

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-32736 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32736 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vr5m-3h59-7jcp · Vendor Advisory
• https://github.com/thinkjs/think-helper/security/advisories/GHSA-vr5m-3h59-7jcp · Note
• https://github.com/thinkjs/think-helper · Note
• https://t.me/cvenotify/19751 · Telegram Post
• https://t.me/cvenotify/33596 · Telegram Post