Vulnerability Description
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oroinc | Oroplatform | >= 4.1.0, < 4.1.14 |
Related Weaknesses (CWE)
References
- https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464PatchThird Party Advisory
- https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hjMitigationThird Party Advisory
- https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464PatchThird Party Advisory
- https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hjMitigationThird Party Advisory
FAQ
What is CVE-2021-43852?
CVE-2021-43852 is a vulnerability with a CVSS score of 8.8 (HIGH). OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototy...
How severe is CVE-2021-43852?
CVE-2021-43852 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43852?
Check the references section above for vendor advisories and patch information. Affected products include: Oroinc Oroplatform.