PT-2021-21941 · Npm+2 · Object-Path+2

Published 2021-09-17 · Updated 2023-03-22 · CVE-2021-3805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: object-path (affected versions not specified)

Description: The issue is related to Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution'. This occurs because the del() function does not properly validate which Object properties it deletes, allowing attackers to modify the prototype of Object. As a result, default properties like toString on all objects can be modified.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-3805

DLA-3291-1

GHSA-8V63-CQQC-6R2C

USN-5967-1

Affected Products

Linuxmint

Ubuntu

Object-Path

References · 22

• 🔥 https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053 · Exploit
• https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3805 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3805 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5967-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5967-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8v63-cqqc-6r2c · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23434 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3291-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3805 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15256 · Vendor Advisory