CVE-2021-23518
Assigner: snyk
Published: 2022-01-21T00:00:00
State: PUBLISHED
title: Prototype Pollution
datePublic: 2022-01-21T00:00:00
descriptions: value: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
affected: vendor: n/a
product: cached-path-relative
versions: version: unspecified
lessThan: 1.1.0
status: affected
versionType: custom
credits: value: P.Adithya Srinivas
value: Masudul Hasan Masud Bhuiyan
value: Cristian-Alexandru Staicu
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
baseScore: 7.3
temporalScore: 6.9
baseSeverity: HIGH
temporalSeverity: MEDIUM
problemTypes: descriptions: type: text
description: Prototype Pollution