CVE-2021-23452

EUVD-2021-2155 · Published Oct 21, 2021

Prototype Pollution in x-assign This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.

Technologies

Binaryops X-AssignX-Assign X-Assign

Weaknesses

CWE-1321CWE-915

CVSS scores

v3.18.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth

T1190Exploit Public-Facing Application T1574.010Services File Permissions Weakness

References

https://snyk.io/vuln/SNYK-JS-XASSIGN-1759314
https://runkit.com/embed/sq8qjwemyn8t
https://nvd.nist.gov/vuln/detail/CVE-2021-23452
https://github.com/mvoorberg/x-assign

Potentially impacted assets

See if this affects your attack surface