PT-2022-11686 · Unknown · Cronvel Tree-Kit

Published 2022-12-25 · Updated 2024-05-17 · CVE-2021-4278

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cronvel tree-kit versions up to 0.6.x

Description A problematic vulnerability has been found, affecting an unknown part of the software. The issue leads to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'.

Recommendations For cronvel tree-kit versions up to 0.6.x, upgrade to version 0.7.0 to address this issue.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-4278

GHSA-MW4X-G2X8-QCVF

Affected Products

Cronvel Tree-Kit

References · 8

• https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd · Patch
• https://github.com/cronvel/tree-kit/releases/tag/v0.7.0 · Patch
• https://osv.dev/vulnerability/CVE-2021-4278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4278 · Security Note
• https://osv.dev/vulnerability/GHSA-mw4x-g2x8-qcvf · Vendor Advisory
• https://github.com/cronvel/tree-kit · Note
• https://vuldb.com/?ctiid.216765 · Note
• https://vuldb.com/?id.216765 · Note