CVE-2021-23450

moderate-risk

Published 2021-12-17

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

Do I need to act?

2.0% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Dojo

Communications Policy Management

Primavera Unifier

Weblogic Server

Debian Linux

Debian Oracle Linuxfoundation

Broken Link https://github.com/dojo/dojo/blob/4c39c14349408fc8274e19b399ffc660512ed07c/_base...

Mailing List https://lists.debian.org/debian-lts-announce/2023/01/msg00030.html

Exploit https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2313036

Exploit https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2313035

Exploit https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBDOJO-2313034

Exploit https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2313033

Exploit https://snyk.io/vuln/SNYK-JS-DOJO-1535223

Patch https://www.oracle.com/security-alerts/cpuapr2022.html

Patch https://www.oracle.com/security-alerts/cpujul2022.html