PT-2021-15529

CVE-2021-23444

Published

2021-09-21

Updated

2021-10-02

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jointjs versions prior to 3.4.2

Description A type confusion issue can lead to a bypass when user-provided keys used in the path parameter are arrays in the setByPath function.

Recommendations For versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the setByPath function with array values in the path parameter until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers

CVE-2021-23444