Vulnerability Details : CVE-2021-23568
Potential exploit
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
Products affected by CVE-2021-23568
- cpe:2.3:a:eggjs:extend2:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-23568
0.65%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-23568
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
7.3
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
3.9
|
3.4
|
Snyk |
CWE ids for CVE-2021-23568
-
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-23568
-
https://github.com/eggjs/extend2/pull/2
fix: __proto__ copy by popomore · Pull Request #2 · eggjs/extend2 · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/eggjs/extend2/commit/aa332a59116c8398976434b57ea477c6823054f8
fix: __proto__ copy (#2) · eggjs/extend2@aa332a5 · GitHubPatch;Third Party Advisory
-
https://snyk.io/vuln/SNYK-JS-EXTEND2-2320315
Prototype Pollution in extend2 | CVE-2021-23568 | SnykExploit;Third Party Advisory
-
https://github.com/eggjs/extend2/blob/master/index.js%23L50-L60
Page not found · GitHub · GitHubBroken Link
Jump to