CVE-2021-23450CWE-1321

CVE-2021-23450

High · published December 18, 2021

CVSS v3.1
7.5
EPSS
30%
Percentile
98.2
In the wild
Unconfirmed
What it is

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.30367 · 98.2th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2021-12-18T01:15Z
Affected products (10)
ProductVersionsFixed in
linuxfoundation/dojo< 1.17.01.17.0
oracle/communications_policy_managementall versions—
oracle/primavera_unifier≥ 17.7, ≤ 17.12—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/primavera_unifierall versions—
oracle/weblogic_serverall versions—
oracle/weblogic_serverall versions—
debian/debian_linuxall versions—
References (18)
https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033 · af854a3a-2127-422b-91ae-364da2661108https://snyk.io/vuln/SNYK-JS-DOJO-1535223 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172 · [email protected]https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036 · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035 · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034 · [email protected]https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033 · [email protected]https://snyk.io/vuln/SNYK-JS-DOJO-1535223 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]
EPSS history
Timeline
  • 17 DEC 20:05Z
    Prototype Pollution
    cvelistv5