{"id":"CVE-2021-3757","published":"2021-09-02T12:06:26Z","modified":"2024-08-03T17:09:09Z","title":"Prototype Pollution in immerjs/immer","vendor":"immerjs","product":"immerjs/immer","tier":"tail","description":{"text":"immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01664,"percentile":0.76659,"provenance":"source"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237","tags":["x_refsource_MISC"]},{"url":"https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa","tags":["x_refsource_CONFIRM"]}],"priority":{"score":20.6,"factors":[{"name":"EPSS percentile","points":15.33},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"immerjs","affectedVersions":[{"vendor":"immerjs","product":"immerjs/immer","versions":[">= unspecified, <= 9.0.5"]}],"affected":[{"ecosystem":"npm","package":"immer","vulnerableRanges":[">=7.0.0, <9.0.6"],"patched":["9.0.6"],"from":["GHSA-c36v-fmgq-m8hx"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2031","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-immerjs-immer-cve-2020-28477","parents":[{"from":"CVE-2020-28477","to":"CVE-2021-3757","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/plugins/patches.ts"],"commits":["https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5","https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237"],"basis":"shared function","functions":["enablePatches"]},{"kind":"similar","provenance":"machine","score":0.54,"basis":"same package + description similarity"}]}]}}