CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
74.8%
In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method lib/utils/object/set.ts
. This method is used throughout the codebase for various operations throughout Dynamoose.
We have not seen any evidence of this vulnerability being exploited.
We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.
v2.7.0 includes a patch for this vulnerability.
We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.
If you have any questions or comments about this advisory:
github.com/advisories/GHSA-rrqm-p222-8ph2
github.com/dynamoose/dynamoose/commit/324c62b4709204955931a187362f8999805b1d8e
github.com/dynamoose/dynamoose/releases/tag/v2.7.0
github.com/dynamoose/dynamoose/security/advisories/GHSA-rrqm-p222-8ph2
nvd.nist.gov/vuln/detail/CVE-2021-21304
www.npmjs.com/package/dynamoose
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
74.8%