Vulnerability · Published Dec 17, 2021 · Assigned by snyk
CVE-2021-23450Prototype Pollution
High 7.5
In plain English
A high-severity security flaw in dojo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 30.4% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)30.4%top 1.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dojo | 1.17.2+dfsg1-1 | DEBIAN-CVE-2021-23450 |
| Debian:13 | dojo | 1.17.2+dfsg1-1 | DEBIAN-CVE-2021-23450 |
| Debian:14 | dojo | 1.17.2+dfsg1-1 | DEBIAN-CVE-2021-23450 |
| Ubuntu:22.04:LTS | dojo | 1.15.4+dfsg1-1ubuntu0.1 | USN-7569-1 |
| Ubuntu:22.04:LTS | dojo | 1.15.4+dfsg1-1ubuntu0.1 | UBUNTU-CVE-2021-23450 |
| npm | dojo | no fix listed | GHSA-m8gw-hjpr-rjv7 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-DOJO-1535223
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036
- https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base/lang.js%23L172
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230129 [SECURITY] [DLA 3289-1] dojo security update mailing-list