PT-2022-9399 · Min-Dash · Min-Dash

Cristian-Alexandru Staicu + 2 · Published 2022-01-21 · Updated 2022-02-01 · CVE-2021-23460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions min-dash versions prior to 3.8.1

Description The issue concerns Prototype Pollution via the set method due to missing enforcement of key types.

Recommendations For versions prior to 3.8.1, update to version 3.8.1 or later to resolve the issue.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23460

GHSA-2M53-83F3-562J

GHSA-FM93-FHH2-CG2C

SNYK-JAVA-ORGWEBJARSNPM-2342127

SNYK-JS-MINDASH-2340605

Affected Products

Min-Dash

References · 14

• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2342127 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-MINDASH-2340605 · Exploit
• https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320 · Patch
• https://github.com/bpmn-io/min-dash/pull/21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23460 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23460 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm93-fhh2-cg2c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2m53-83f3-562j · Vendor Advisory
• https://github.com/bpmn-io/min-dash/commit/2c6689e2aa29f4b66a4874a2f3003431e9db48d1 · Note
• https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32 · Note
• https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js#L32 · Note
• https://github.com/bpmn-io/min-dash/security/advisories/GHSA-2m53-83f3-562j · Note
• https://github.com/bpmn-io/min-dash · Note
• https://t.me/cibsecurity/36060 · Telegram Post