9.1

CVE-2021-41097

Exploit

Prototype pollution in aurelia-path

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`. The problem is patched in version `1.1.7`.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bluespire ≫ Aurelia-path SwPlatformnode.js Version < 1.1.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.92% 0.91
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
security-advisories@github.com 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

https://github.com/aurelia/path/commit/7c4e235433a4a2df9acc313fbe891758084fdec1
Patch
Third Party Advisory
https://github.com/aurelia/path/issues/44
Third Party Advisory
Exploit
Issue Tracking
https://github.com/aurelia/path/releases/tag/1.1.7
Third Party Advisory
Release Notes
https://github.com/aurelia/path/security/advisories/GHSA-3c9c-2p65-qvwv
Third Party Advisory
Mitigation
https://www.npmjs.com/package/aurelia-path
Third Party Advisory
Product