cve.bz

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution), page 10

Filter

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

What the weakness is: CWE-1321 at MITRE. All weaknesses

Related attack patterns (CAPEC): 3
  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-1321, as MITRE names them. Credits.

Ask an AI about CWE-1321

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1321: Improperly Controlled Modification of Object Prototype Attributes and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1321.html and https://cve.bz/cve/cwe/1321?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-21231EPSS 1.4%

    All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)

  2. 7.5CVE-2022-25871EPSS 1.2%

    All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete …

  3. 7.5CVE-2022-21213EPSS 2.1%

    This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both c…

  4. 7.5CVE-2022-25878EPSS 2.3%

    The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to…

  5. 7.5CVE-2022-25862EPSS 0.7%

    This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix…

  6. 9.8CVE-2022-21190EPSS 4.0%

    This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) …

  7. 9.1CVE-2021-42581EPSS 1.4%

    Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to …

  8. 7.5CVE-2022-25324EPSS 1.5%

    All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.

  9. 9.8CVE-2022-25301EPSS 1.2%

    All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.

  10. 8.1CVE-2022-25645EPSS 1.8%

    All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a m…

  11. 9.8CVE-2022-22143EPSS 2.2%

    The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security…

  12. 9.8CVE-2022-21189EPSS 1.7%

    The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or c…

  13. 7.5CVE-2022-24279EPSS 1.3%

    The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020…

  14. 7.5CVE-2022-21803EPSS 1.8%

    This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vu…

  15. 9.8CVE-2022-1295EPSS 1.3%

    Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.

  16. 7.8CVE-2021-43138EPSS 3.3%

    In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

  17. 9.8CVE-2022-24802EPSS 1.7%

    deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in ver…

  18. 9.8CVE-2022-26260EPSS 1.3%

    Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().

  19. 9.8CVE-2021-44906EPSS 4.6%

    Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  20. 9.8CVE-2022-25354EPSS 1.9%

    The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https:…

  21. 9.8CVE-2022-25352EPSS 2.1%

    The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-105…

  22. 7.3CVE-2022-25296EPSS 1.0%

    The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives fr…

  23. 9.8CVE-2021-44908EPSS 1.8%

    SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().

  24. 6.5CVE-2021-23771EPSS 1.0%

    This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to…

  25. 6.1CVE-2021-43956EPSS 0.7%

    The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.

  26. 10.0CVE-2022-24760EPSS 49%

    Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. Th…

  27. 6.1CVE-2022-23395EPSS 1.1%

    jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

  28. 8.2CVE-2022-21824EPSS 22%

    Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first par…

  29. 9.8CVE-2021-23702EPSS 1.4%

    The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.

  30. 9.8CVE-2022-22912EPSS 2.6%

    Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.

  31. 9.8CVE-2021-23682EPSS 2.1%

    This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not…

  32. 7.5CVE-2021-23597EPSS 2.0%

    This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULT…

  33. 9.8CVE-2022-23631EPSS 2.7%

    superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or know…

  34. 8.8CVE-2022-23624EPSS 1.2%

    Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation …

  35. 8.8CVE-2022-23623EPSS 1.2%

    Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not…

  36. 9.8CVE-2021-23507EPSS 2.1%

    The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://securi…

  37. 9.8CVE-2021-23497EPSS 3.7%

    This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/…

  38. 9.8CVE-2021-23470EPSS 1.3%

    This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vul…

  39. 6.1CVE-2022-0432ExploitEPSS 4.4%

    Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.

  40. 9.8CVE-2021-23760EPSS 1.7%

    The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives fr…

  41. 9.8CVE-2021-23558EPSS 1.6%

    The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-5…

  42. 9.8CVE-2021-23518EPSS 1.9%

    The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype pro…

  43. 7.5CVE-2021-23460EPSS 2.2%

    The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.

  44. 10.0CVE-2021-23594EPSS 1.8%

    All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

  45. 9.8CVE-2021-23568EPSS 1.5%

    The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.

  46. 9.8CVE-2021-23543EPSS 1.8%

    All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.

  47. 8.8CVE-2021-43852EPSS 1.1%

    OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this inject…

  48. 9.8CVE-2021-23574EPSS 2.2%

    All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).

  49. 9.8CVE-2021-23450EPSS 30%

    All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

  50. 9.8CVE-2021-23700EPSS 1.2%

    All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.