Moole Vulnerability Database

Find real vulnerabilities before they ship

Unknown

CVE-2021-23329

The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.

PublishedJan 31, 2021, 16:15

Published Byreport@snyk.io

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

nested-object-assign(npm)01.0.4N/A

References

https://github.com/Geta/NestedObjectAssign/pull/11
https://snyk.io/vuln/SNYK-JS-NESTEDOBJECTASSIGN-1065977

Weakness Type

CWE-1321

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK