PT-2023-12411 · Unknown · Yomguithereal Baobab

Yomguithereal · Published 2023-01-07 · Updated 2024-05-17 · CVE-2021-4307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yomguithereal Baobab versions up to 2.6.0

Description A critical issue affects an unknown functionality, leading to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. This can be exploited remotely.

Recommendations To address this issue, upgrade to version 2.6.1. As a temporary workaround, consider restricting access to components that may be affected by the 'prototype pollution' issue until the patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-4307

GHSA-WVR2-Q86M-6WHP

Affected Products

Yomguithereal Baobab

References · 13

• 🔥 https://github.com/Yomguithereal/baobab/pull/511 · Exploit
• https://github.com/Yomguithereal/baobab/releases/tag/2.6.1 · Patch
• https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-4307 · Security Note
• https://osv.dev/vulnerability/GHSA-wvr2-q86m-6whp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4307 · Vendor Advisory
• https://github.com/Yomguithereal/baobab · Note
• https://t.me/cvenotify/41875 · Telegram Post
• https://vuldb.com/?ctiid.217627 · Note
• https://t.me/cibsecurity/56127 · Telegram Post
• https://t.me/cvenotify/41501 · Telegram Post
• https://vuldb.com/?id.217627 · Note
• https://t.me/cvenotify/62856 · Telegram Post