Vulnerability · Published Dec 24, 2021 · Assigned by snyk
CVE-2021-23574Prototype Pollution
High 7.5
In plain English
A high-severity security flaw in js-data. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.2%top 17.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | js-data | no fix listed | GHSA-c6h4-gc3f-hgjq |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-JSDATA-1584361 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2320790 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2320791 x_refsource_MISC
- https://github.com/js-data/js-data/issues/576 x_refsource_MISC
- https://github.com/js-data/js-data/blob/master/dist/js-data.js%23L472 x_refsource_MISC
- https://github.com/js-data/js-data/issues/577 x_refsource_MISC