GitHub Advisoryadvisory · Maven

GHSA-qhxh-9hhx-6p7v Prototype Pollution in GraphHopper

MEDIUM Published 2021-08-02 Modified 2021-07-26 Official page ↗
Aliases
CVE-2021-23408
Ecosystem
Maven
Packages
com.graphhopper:graphhopper-web-bundle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Weaknesses
CWE-1321
Reviewed
2021-07-26

Affected packages

• Maven com.graphhopper:graphhopper-web-bundle: < 3.2 → fixed in 3.2

Description

This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.

Related

Alias · CVE (1)

  • CVE-2021-23408 This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References