CVE Vulnerabilities

CVE-2021-3805

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Published: Sep 17, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

Name Vendor Start Version End Version
Object-path Object-path_project * 0.11.8 (excluding)
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/grc-ui-api-rhel8:v2.3.3-5 *
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/search-api-rhel8:v2.3.3-5 *
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/search-ui-rhel8:v2.3.3-7 *
Node-object-path Ubuntu bionic *
Node-object-path Ubuntu esm-apps/bionic *
Node-object-path Ubuntu esm-apps/focal *
Node-object-path Ubuntu focal *
Node-object-path Ubuntu hirsute *
Node-object-path Ubuntu impish *
Node-object-path Ubuntu lunar *
Node-object-path Ubuntu mantic *
Node-object-path Ubuntu oracular *
Node-object-path Ubuntu trusty *
Node-object-path Ubuntu xenial *

Potential Mitigations

References