Vulnerability Description
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adaltas | Mixme | < 0.5.1 |
Related Weaknesses (CWE)
References
- http://nodejs.comThird Party AdvisoryURL Repurposed
- https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cPatchThird Party Advisory
- https://github.com/adaltas/node-mixme/issues/1Issue TrackingThird Party Advisory
- https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210618-0005/Third Party Advisory
- https://www.npmjs.com/~davidThird Party Advisory
- http://nodejs.comThird Party AdvisoryURL Repurposed
- https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cPatchThird Party Advisory
- https://github.com/adaltas/node-mixme/issues/1Issue TrackingThird Party Advisory
- https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4PatchThird Party Advisory
- https://security.netapp.com/advisory/ntap-20210618-0005/Third Party Advisory
- https://www.npmjs.com/~davidThird Party Advisory
FAQ
What is CVE-2021-28860?
CVE-2021-28860 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to ...
How severe is CVE-2021-28860?
CVE-2021-28860 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-28860?
Check the references section above for vendor advisories and patch information. Affected products include: Adaltas Mixme.