9.8

CVE-2021-4307

Exploit

Yomguithereal Baobab prototype pollution

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Baobab Project ≫ Baobab Version >= 2.0.0 < 2.6.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.26% 0.657
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cna@vuldb.com 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
cna@vuldb.com 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19
Patch
https://github.com/Yomguithereal/baobab/pull/511
Patch
Third Party Advisory
Exploit
https://github.com/Yomguithereal/baobab/releases/tag/2.6.1
Release Notes
https://vuldb.com/?ctiid.217627
Third Party Advisory
VDB Entry
https://vuldb.com/?id.217627
Third Party Advisory
VDB Entry