GitHub Advisoryadvisory · Packagist

GHSA-jx5q-g37m-h5hj Client-Side JavaScript Prototype Pollution in oro/platform

MEDIUM Published 2022-01-06 Modified 2022-01-04 Official page ↗
Aliases
CVE-2021-43852
Ecosystem
Packagist
Packages
oro/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321, CWE-74
Reviewed
2022-01-04

Affected packages

• Packagist oro/platform: >= 4.1.0, < 4.1.14 → fixed in 4.1.14 • Packagist oro/platform: >= 4.2.0, < 4.2.8 → fixed in 4.2.8

Description

Summary By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. Workarounds Configure WAF to drop requests containing next strings: `__proto__` , `constructor[prototype]`, `constructor.prototype`

Related

Alias · CVE (1)

  • CVE-2021-43852 OroPlatform is a PHP Business Application Platform. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References