This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
References
Link | Resource |
---|---|
https://github.com/appwrite/appwrite/pull/2778 | Patch Third Party Advisory |
https://github.com/appwrite/appwrite/releases/tag/0.11.1 | Release Notes Third Party Advisory |
https://github.com/appwrite/appwrite/releases/tag/0.12.2 | Release Notes Third Party Advisory |
https://github.com/litespeed-js/litespeed.js/pull/18 | Patch Third Party Advisory |
https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250 | Exploit Third Party Advisory |
https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: snyk
Published: 2022-02-16T00:00:00
Updated: 2022-02-16T17:05:26
Reserved: 2021-01-08T00:00:00
Link: CVE-2021-23682
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-02-16T17:15:10.713
Modified: 2022-02-24T03:35:56.657
Link: CVE-2021-23682
JSON object: View
Redhat Information
No data.
CWE