PT-2021-7298 · Dojo+3 · Dojo+3

Published

2021-12-17

·

Updated

2025-10-21

·

CVE-2021-23450

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions dojo versions all
Description The issue is related to the incorrect management of code generation in the dojo library's setObject function. This can allow a remote attacker to execute arbitrary code. The vulnerability is associated with Prototype Pollution via the setObject function.
Recommendations For all versions of dojo, consider disabling the setObject function as a temporary workaround until a patch is available. Restrict access to the dojo library to minimize the risk of exploitation. Avoid using the setObject function in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Prototype Pollution

Weakness Enumeration

CWE-94CWE-1321

Related Identifiers

BDU:2022-05474
CVE-2021-23450
DLA-3289-1
GHSA-M8GW-HJPR-RJV7
MGASA-2023-0039
SNYK-JAVA-ORGWEBJARS-2313036
SNYK-JAVA-ORGWEBJARSBOWER-2313035
SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034
SNYK-JAVA-ORGWEBJARSNPM-2313033
SNYK-JS-DOJO-1535223
USN-7569-1

Affected Products

Astra Linux
Linuxmint
Ubuntu
Dojo