{"id":"CVE-2021-23436","published":"2021-09-01T17:30:09Z","modified":"2024-09-16T16:28:32Z","title":"Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === \"__proto__\" || p === \"constructor\") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01795,"percentile":0.78365,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-IMMER-1540542","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266","tags":["x_refsource_MISC"]},{"url":"https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237","tags":["x_refsource_MISC"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":15.67},{"name":"CVSS severity","points":3.92}]},"affectedVersions":[{"vendor":"n/a","product":"immer","versions":[">= unspecified, < 9.0.6"]}],"affected":[{"ecosystem":"npm","package":"immer","vulnerableRanges":[">=7.0.0, <9.0.6"],"patched":["9.0.6"],"from":["GHSA-33f9-j839-rf8h"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1957","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-immerjs-immer-cve-2020-28477","parents":[{"from":"CVE-2020-28477","to":"CVE-2021-23436","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays.","from":"CVE.org","in":"CVE-2021-23436"},{"kind":"same-code","provenance":"machine","files":["src/plugins/patches.ts"],"commits":["https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5","https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237"],"basis":"shared function","functions":["enablePatches"]}]}]}}