Security Bulletin: Vulnerability in min-dash affects IBM Process Mining [CVE-2021-23460]

Summary There is a vulnerability in min-dash that could allow a remote attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. CVE-2021-23460 Vulnerability Details...

@hbtgmbh/dmn-eval-js (>=1.4.0 <=1.5.0), @hbtgmbh/dmn-server (>=1.0.0 <=1.0.2) +33 more potentially affected by CVE-2021-23460 via min-dash (>=1.1.0 <=3.5.2)

min-dash NPM version =1.1.0, =1.4.0, =1.0.0, =0.16.0, =1.0.105, =1.0.0, =1.0.33, =1.0.1, =0.28.0, =0.1.0, =3.0.0, =1.0.0, =0.2.0, =0.11.0, =3.0.0, =4.0.0 and more Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

CVE-2021-23460

creationtimestamp| type| source ---|---|--- 2022-01-21 22:14:14+00:00| seen| https://t.me/cibsecurity/36060 2022-01-27 16:09:19+00:00| published-proof-of-concept| https://github.com/bpmn-io/min-dash/security/advisories/GHSA-2m53-83f3-562j...

CVE-2021-23460 Prototype Pollution

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types...

entfrm-bpmn (>=8.6.2 <=8.6.6), entfrm-flowable-designer (>=1.0.0 <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (=3.5.2)

min-dash NPM version =3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: SNYK:JS-MINDASH-2340605...