PT-2021-6594 · Set-Value · Set-Value
Ready-Research
·
Published
2021-09-12
·
Updated
2022-03-29
·
CVE-2021-23440
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
set-value versions prior to 2.0.1
set-value versions 3.0.0 through 4.0.0
Description
The issue is related to a type confusion vulnerability in the set-value module, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability can be triggered when user-provided keys used in the
path parameter are arrays.Recommendations
For set-value versions prior to 2.0.1, update to version 2.0.1 or later.
For set-value versions 3.0.0 through 4.0.0, update to version 4.0.1 or later.
As a temporary workaround, consider restricting the use of the
path parameter to minimize the risk of exploitation. Avoid using array values for the path parameter until the issue is resolved.Exploit
Fix
Prototype Pollution
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Set-Value