Prototype Pollution in async
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-43138US | high7.8 | — | ||
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/caolan/asyncPACKAGE
- https://github.com/caolan/async/blob/master/lib/internal/iterator.jsWEB
- https://github.com/caolan/async/blob/master/lib/mapValuesLimit.jsWEB
- https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264WEB
- https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2WEB
- https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66dWEB
- https://github.com/caolan/async/compare/v2.6.3...v2.6.4WEB
- https://github.com/caolan/async/pull/1828WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan