Home > Vulnerability Database > CVE-2021-23460

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2021-23460

Good to know:

Date: January 21, 2022

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

Language: JS

Severity Score

7.5

Related Resources (9)

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-23460

Url: https://github.com/bpmn-io/min-dash/pull/21

Url: https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js#L32

Url: https://github.com/bpmn-io/min-dash/security/advisories/GHSA-2m53-83f3-562j

Url: https://github.com/bpmn-io/min-dash/pull/21/commits/5ab05cbc4fd8d5eafb7db540c491ed0906b9d320

Url: https://github.com/bpmn-io/min-dash/commit/2c6689e2aa29f4b66a4874a2f3003431e9db48d1

Url: https://github.com/bpmn-io/min-dash

Url: https://github.com/bpmn-io/min-dash/blob/c4d579c0eb2ed0739592111c3906b198921d3f52/lib/object.js%23L32

Url: https://www.mend.io/vulnerability-database/CVE-2021-23460

Severity Score

7.5

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version min-dash - 3.8.1;org.webjars.npm:min-dash:3.8.1

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Do you need more information?

Contact Us