GHSA-p92x-r36w-9395

Source

https://github.com/advisories/GHSA-p92x-r36w-9395

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-p92x-r36w-9395/GHSA-p92x-r36w-9395.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-p92x-r36w-9395

Aliases

CVE-2021-23438

Published

2021-09-02T22:02:25Z

Modified

2025-01-08T10:42:05.906784Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Type confusion in mpath

Details

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Database specific

{
    "nvd_published_at": "2021-09-01T19:15:00Z",
    "cwe_ids": [
        "CWE-843"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-02T17:06:28Z"
}

References

Affected packages

npm / mpath

Package

Name: mpath; View open source insights on deps.dev
Purl: pkg:npm/mpath

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.4

Ecosystem specific

{
    "affected_functions": [
        "(mpath).get",
        "(mpath).has",
        "(mpath).unset",
        "(mpath).set"
    ]
}