Vulnerability Description
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cached-Path-Relative Project | Cached-Path-Relative | < 1.1.0 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/ashaffer/cached-path-relative/commit/40c73bf70c58add5aec7d11ePatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00006.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2348246ExploitIssue TrackingPatch
- https://snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-2342653ExploitIssue TrackingPatch
- https://github.com/ashaffer/cached-path-relative/commit/40c73bf70c58add5aec7d11ePatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/12/msg00006.htmlMailing ListThird Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2348246ExploitIssue TrackingPatch
- https://snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-2342653ExploitIssue TrackingPatch
FAQ
What is CVE-2021-23518?
CVE-2021-23518 is a vulnerability with a CVSS score of 7.3 (HIGH). The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which al...
How severe is CVE-2021-23518?
CVE-2021-23518 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-23518?
Check the references section above for vendor advisories and patch information. Affected products include: Cached-Path-Relative Project Cached-Path-Relative, Debian Debian Linux.