Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-43138

Good to know:

icon
icon

Date: April 5, 2022

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Language: JS

Severity Score

Related Resources (21)

https://access.redhat.com/security/cve/CVE-2021-43138
https://nvd.nist.gov/vuln/detail/CVE-2021-43138
https://jsfiddle.net/oz5twjd9/
https://github.com/caolan/async/compare/v2.6.3...v2.6.4
https://github.com/caolan/async/blob/master/lib/internal/iterator.js
https://github.com/caolan/async
https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d
https://github.com/caolan/async/pull/1828
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264
https://jsfiddle.net/oz5twjd9
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
https://security.netapp.com/advisory/ntap-20240621-0006
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.netapp.com/advisory/ntap-20240621-0006/
https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2
https://www.mend.io/vulnerability-database/CVE-2021-43138

Severity Score

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

icon

Upgrade Version

Upgrade to version async - 3.2.2;async - 2.6.4;async - 3.2.2;async - 2.6.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us