cve.bz

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution), page 11

Filter

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

What the weakness is: CWE-1321 at MITRE. All weaknesses

Related attack patterns (CAPEC): 3
  • CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-1321, as MITRE names them. Credits.

Ask an AI about CWE-1321

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1321: Improperly Controlled Modification of Object Prototype Attributes and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1321.html and https://cve.bz/cve/cwe/1321?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2021-23663EPSS 1.2%

    All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.

  2. 9.8CVE-2021-23561EPSS 1.2%

    All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.

  3. 9.8CVE-2021-3815EPSS 0.9%

    utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  4. 6.1CVE-2021-43787EPSS 1.3%

    Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing…

  5. 9.8CVE-2021-23433EPSS 1.9%

    The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note t…

  6. 9.8CVE-2021-3918EPSS 3.8%

    json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  7. 9.8CVE-2021-23452EPSS 1.6%

    This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.

  8. 10.0CVE-2021-23449EPSS 3.6%

    This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

  9. 9.8CVE-2021-23448EPSS 1.2%

    All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.

  10. 7.5CVE-2021-41097ExploitEPSS 4.9%

    aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-…

  11. 9.8CVE-2021-39227EPSS 1.3%

    ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular dat…

  12. 9.8CVE-2021-23442EPSS 1.6%

    This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

  13. 7.5CVE-2021-3805EPSS 2.0%

    object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  14. 6.1CVE-2021-39205EPSS 1.2%

    Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incide…

  15. 9.8CVE-2021-3666EPSS 1.3%

    body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  16. 9.8CVE-2021-3645EPSS 1.4%

    merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  17. 9.8CVE-2021-3766EPSS 1.5%

    objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  18. 9.8CVE-2021-3757EPSS 1.7%

    immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  19. 9.8CVE-2021-23421EPSS 1.1%

    All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

  20. 9.8CVE-2021-23419EPSS 1.1%

    This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.

  21. 7.2CVE-2021-32811EPSS 2.3%

    Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.…

  22. 7.2CVE-2021-32807EPSS 2.1%

    The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. T…

  23. 9.8CVE-2021-23417EPSS 1.1%

    All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.

  24. 4.3CVE-2021-23408EPSS 1.4%

    This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.

  25. 9.8CVE-2021-25953EPSS 3.0%

    Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.

  26. 9.8CVE-2021-25952EPSS 3.3%

    Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.

  27. 9.8CVE-2021-23403EPSS 1.3%

    All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.

  28. 9.8CVE-2021-23402EPSS 1.2%

    All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.

  29. 7.5CVE-2021-32736EPSS 1.0%

    think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, bu…

  30. 9.8CVE-2021-23396EPSS 1.0%

    All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.

  31. 7.5CVE-2020-24939EPSS 1.7%

    Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.

  32. 5.3CVE-2021-23395EPSS 0.9%

    This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.

  33. 9.8CVE-2021-25949EPSS 3.3%

    Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

  34. 9.8CVE-2021-25948EPSS 3.3%

    Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

  35. 9.8CVE-2021-25947EPSS 3.0%

    Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.

  36. 9.8CVE-2021-26707EPSS 1.9%

    The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-…

  37. 9.8CVE-2021-25945EPSS 3.0%

    Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

  38. 9.8CVE-2021-25946EPSS 3.3%

    Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.

  39. 9.8CVE-2021-25944EPSS 3.0%

    Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.

  40. 9.8CVE-2021-25943EPSS 3.3%

    Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.

  41. 9.8CVE-2021-25941EPSS 3.3%

    Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

  42. 9.8CVE-2021-23383EPSS 4.5%

    The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

  43. 9.1CVE-2021-28860EPSS 1.8%

    In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will …

  44. 9.8CVE-2021-25928EPSS 3.4%

    Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.

  45. 9.8CVE-2021-25927EPSS 3.3%

    Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

  46. 8.8CVE-2021-20089EPSS 1.6%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in purl 2.3.2 allows a malicious user to inject properties into Object.prototype.

  47. 8.8CVE-2021-20086ExploitEPSS 6.1%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.

  48. 8.8CVE-2021-20085EPSS 1.6%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.

  49. 8.8CVE-2021-20083EPSS 4.2%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.

  50. 8.8CVE-2021-20088EPSS 1.4%

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.