CVE-2021-23682
Prototype Pollution
- State
- Published
- Severity
- 7.3 High
- Published
- Feb 16, 2022
- Updated
- Sep 16, 2024
- Reserved
- Jan 8, 2021
Description
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P | snyk |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
litespeed.jsn/a |
|
appwrite/server-cen/a |
|
References
- https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250
- https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820
- https://github.com/litespeed-js/litespeed.js/pull/18
- https://github.com/appwrite/appwrite/releases/tag/0.12.2
- https://github.com/appwrite/appwrite/pull/2778
- https://github.com/appwrite/appwrite/releases/tag/0.11.1
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.