Vulnerability · Published Jul 21, 2021 · Assigned by snyk
CVE-2021-23408Prototype Pollution
Medium 5.4
In plain English
A medium-severity security flaw in com.graphhopper:graphhopper-web-bundle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.4%top 27.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.graphhopper:graphhopper-web-bundle | 3.2 | GHSA-qhxh-9hhx-6p7v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | com.graphhopper:graphhopper-web-bundle | unspecified – before 3.24.0-pre1 – before unspecifiedunspecified – before 4.0 |
References
- https://snyk.io/vuln/SNYK-JAVA-COMGRAPHHOPPER-1320114 x_refsource_MISC
- https://github.com/graphhopper/graphhopper/pull/2370 x_refsource_MISC
- https://github.com/graphhopper/graphhopper/releases/tag/3.2 x_refsource_MISC
- https://github.com/graphhopper/graphhopper/releases/tag/3.1 x_refsource_MISC