{"id":"CVE-2021-3805","published":"2021-09-17T00:00:00Z","modified":"2024-08-03T17:09:09Z","title":"Prototype Pollution in mariocasciaro/object-path","vendor":"mariocasciaro","product":"mariocasciaro/object-path","tier":"tail","description":{"text":"object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0204,"percentile":0.81131,"provenance":"source"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"references":[{"url":"https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053","tags":[]},{"url":"https://github.com/mariocasciaro/object-path/commit/e6bb638ffdd431176701b3e9024f80050d0ef0a6","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00031.html","tags":["mailing-list"]}],"priority":{"score":21.5,"factors":[{"name":"EPSS percentile","points":16.23},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"mariocasciaro","affectedVersions":[{"vendor":"mariocasciaro","product":"mariocasciaro/object-path","versions":[">= unspecified, < 0.11.8"]}],"affected":[{"ecosystem":"npm","package":"object-path","vulnerableRanges":["<0.11.8"],"patched":["0.11.8"],"from":["GHSA-8v63-cqqc-6r2c"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2018","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-15256","published":"2020-10-19","fixed":"0.11.5","kev":false},{"cve":"CVE-2021-23434","published":"2021-08-27","fixed":"0.11.6","kev":false,"link":{"from":"CVE-2021-23434","to":"CVE-2021-3805","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:object-path","fromFixed":"0.11.6","toFixed":"0.11.8","daysApart":21}]}},{"cve":"CVE-2021-3805","published":"2021-09-17","fixed":"0.11.8","kev":false}],"package":"npm:object-path"}}