CVE-2021-23440 Prototype Pollution
Attackers can bypass prototype pollution protections in the set-value library by using array keys, potentially leading to unexpected application behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23440?
CVE-2021-23440 is a high-severity vulnerability in Oracle Communications Cloud Native Core Policy, published on 12 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Weakness: CWE-843
Which versions are affected by CVE-2021-23440?
8 open source packages ship an affected version, including set-value and set-value-nuget. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
set-value npm | All versions | 2.0.1 |
set-value npm | All versions | 2.0.1 |
set-value npm | From 3.0.0 | 3.0.3 |
set-value npm | From 3.0.0 | 3.0.3 |
set-value npm | From 4.0.0 | 4.0.1 |
set-value npm | From 4.0.0 | 4.0.1 |
2 more packages
set-value-nuget NuGet | All versions | 2.0.0 |
set-value-nuget NuGet | All versions | 2.0.0 |
Products include Oracle Communications Cloud Native Core Policy, Set-Value Project Set-Value.
How do I fix CVE-2021-23440?
Upgrade set-value to a fixed version for your release line: 2.0.1, 3.0.3 or 4.0.1.
Is CVE-2021-23440 being exploited?
There is no known exploitation of CVE-2021-23440 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2021-35574 Denial of service in Outside In Technology
- CVE-2021-22119 Resource Exhaustion in Spring Security
- CVE-2019-3799 Directory Traversal with spring-cloud-config-server
- CVE-2021-33880 Observable Timing Discrepancy in aaugustin websockets library
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as AZL-45225, DEBIAN-CVE-2021-23440, GHSA-4jqc-8m5r-9rpr, UBUNTU-CVE-2021-23440.