CVE-2024-21505
Assigner: snyk
Published: 2024-03-25T05:00:00.749Z
State: PUBLISHED
metrics: cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
credits: value: Tariq Hawis
problemTypes: descriptions: cweId: CWE-1321
description: Prototype Pollution
descriptions: value: Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
affected: product: web3-utils
versions: version: 0
lessThan: 4.2.1
status: affected
versionType: semver
vendor: n/a