CVE-2021-23760 Prototype Pollution

2022-01-2821:31:30

snyk

www.cve.org

package keyget vulnerability

prototype pollution

denial of service

remote code execution

incomplete fix

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

AI Score

9.9

Confidence

High

EPSS

0.017

Percentile

87.9%

JSON

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. Note: This vulnerability derives from an incomplete fix to CVE-2020-28272