Object-path Project Object-path 0.7.0 for Node.js

CPE Details

Object-path Project Object-path 0.7.0 for Node.js
object-path_project
object-path
0.7.0
2020-10-28
19h02 +00:00
2020-10-28
19h02 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:object-path_project:object-path:0.7.0:*:*:*:*:node.js:*:*

Informations

Vendor

object-path_project

Product

object-path

Version

0.7.0

Target Software

node.js

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-3805 2021-09-16 22h00 +00:00 object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
7.5
Haute
CVE-2021-23434 2021-08-27 16h50 +00:00 This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
8.6
Haute
CVE-2020-15256 2020-10-19 19h25 +00:00 A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
9.8
Critique