PT-2021-15536

CVE-2021-23509

Published

2021-11-03

Updated

2021-11-08

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions json-ptr versions prior to 3.0.0

Description A type confusion issue can lead to a bypass when user-provided keys used in the pointer parameter are arrays. This issue is related to the json-ptr package.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of array values for the pointer parameter until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers

CVE-2021-23509