Description

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Remediation

References

https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-609293

https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md

Related Vulnerabilities

CVE-2021-3810 Vulnerability in npm package code-server

CVE-2016-10735 Vulnerability in maven package fr.norad.bootstrap:bootstrap

CVE-2020-16040 Vulnerability in maven package org.webjars.npm:electron

CVE-2017-18352 Vulnerability in npm package rendertron-middleware

CVE-2021-23446 Vulnerability in npm package handsontable

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Exploit Third Party Advisory Release Notes