EUVD-2022-1728

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Malicious user can gain privileges through mapValues method in Async versions before updates.

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerability CVE-2021-43138	27 Mar 202316:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics Mobile (Android) is affected by multiple vulnerabilities	21 Oct 202415:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	26 Mar 202504:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities	23 Aug 202222:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2022-34339, CVE-2021-3712, CVE-2021-3711, CVE-2021-4160, CVE-2021-29425, CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-43138, CVE-2022-24758)	26 Mar 202502:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Robotic Process Automation is vulnerable to arbitrary code execution due to async (CVE-2021-43138)	25 Jul 202219:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2022	20 Jun 202213:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that run Designer flows may be vulnerable to arbitrary code execution due to [CVE-2021-43138]	28 Apr 202311:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager Virtual Appliance	30 Jun 202305:54	–	ibm

[
  {
    "enisaIdVendor": [
      {
        "id": "abdaba94-bf71-315c-8ead-a6b229985ec8",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "cc2ca07a-4080-3cff-9ab0-d597f573638a",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-43138
github	www.github.com/caolan/async/pull/1828
github	www.github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2
github	www.github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d
github	www.github.com/caolan/async
github	www.github.com/caolan/async/blob/master/lib/internal/iterator.js
github	www.github.com/caolan/async/blob/master/lib/mapValuesLimit.js
github	www.github.com/caolan/async/blob/v2.6.4/CHANGELOG.md
github	www.github.com/caolan/async/compare/v2.6.3...v2.6.4
jsfiddle	www.jsfiddle.net/oz5twjd9

03 Oct 2025 20:07Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.8

CVSS 26.8

EPSS0.00657