ByteOS Network

NVD Vulnerability Details :

CVE-2021-23434

Analyzed

Source-report@snyk.io

Published At-27 Aug, 2021 | 17:15

Updated At-30 Jan, 2023 | 18:24

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Secondary	3.1	5.6	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

object-path_project>>object-path>>Versions before 0.11.6(exclusive)

cpe:2.3:a:object-path_project:object-path:*:*:*:*:*:node.js:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-843	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/mariocasciaro/object-path%230116	report@snyk.io	Broken Link
https://github.com/mariocasciaro/object-path/commit/7bdf4abefd102d16c163d633e8994ef154cab9eb	report@snyk.io	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html	report@snyk.io	Mailing List Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1570423	report@snyk.io	Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453	report@snyk.io	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History