CVE-2021-23807 Prototype Pollution

2021-11-0317:20:29

snyk

www.cve.org

vulnerability

prototype pollution

jsonpointer

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

AI Score

9.7

Confidence

High

EPSS

0.17

Percentile

96.1%

JSON

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

CNA Affected

[
  {
    "product": "jsonpointer",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "5.0.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]