// For flags

CVE-2021-4279

Starcounter-Jack JSON-Patch prototype pollution

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.

Una vulnerabilidad ha sido encontrada en Starcounter-Jack JSON-Patch hasta 3.1.0 y clasificada como problemática. Esta vulnerabilidad afecta a código desconocido. La manipulación conduce a una modificación controlada inadecuadamente de los atributos del prototipo del objeto ("contaminación del prototipo"). El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. La actualización a la versión 3.1.1 puede solucionar este problema. El nombre del parche es 7ad6af41eabb2d799f698740a91284d762c955c9. Se recomienda actualizar el componente afectado. VDB-216778 es el identificador asignado a esta vulnerabilidad.

In Starcounter-Jack JSON-Patch bis 3.1.0 wurde eine problematische Schwachstelle gefunden. Dabei geht es um eine nicht genauer bekannte Funktion. Dank Manipulation mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung. Ein Aktualisieren auf die Version 3.1.1 vermag dieses Problem zu lösen. Der Patch wird als 7ad6af41eabb2d799f698740a91284d762c955c9 bezeichnet. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-12-25 CVE Reserved
  • 2022-12-25 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-08-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Starcounter-jack
Search vendor "Starcounter-jack"
 Json-patch
Search vendor "Starcounter-jack" for product "Json-patch"
 < 3.1.1
Search vendor "Starcounter-jack" for product "Json-patch" and version " < 3.1.1"
-
Affected