Vulnerability · Published Feb 16, 2022 · Assigned by snyk
CVE-2021-23682Prototype Pollution
High 7.3
In plain English
A high-severity security flaw in appwrite/server-ce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | appwrite/server-ce | 0.12.2 | GHSA-v9p9-535w-4285 |
| Packagist | appwrite/server-ce | 0.11.1 | GHSA-v9p9-535w-4285 |
| npm | litespeed.js | 0.3.12 | GHSA-v9p9-535w-4285 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | litespeed.js | unspecified – before 0.3.12 |
| n/a | appwrite/server-ce | 0.12.0 – before unspecifiedunspecified – before 0.12.2unspecified – before 0.11.1 |
References
- https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250 x_refsource_MISC
- https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820 x_refsource_MISC
- https://github.com/litespeed-js/litespeed.js/pull/18 x_refsource_MISC
- https://github.com/appwrite/appwrite/releases/tag/0.12.2 x_refsource_MISC
- https://github.com/appwrite/appwrite/pull/2778 x_refsource_MISC
- https://github.com/appwrite/appwrite/releases/tag/0.11.1 x_refsource_MISC