CVE-2021-43138
async <= 2.6.3 and 3-3.2.2 - Prototype Pollution
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
En Async antes de la versión 2.6.4 y 3.x antes de la versión 3.2.2, un usuario malicioso puede obtener privilegios a través del método mapValues(), también conocido como contaminación del prototipo lib/internal/iterator.js createObjectIterator
A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues() method.
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. Some WordPress plugins and themes use this dependency though that doesn’t necessarily mean the plugin itself is vulnerable to exploitation.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-11-01 CVE Reserved
- 2022-04-06 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-11-10 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| https://github.com/caolan/async/blob/master/lib/internal/iterator.js | Third Party Advisory | |
| https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js | Third Party Advisory | |
| https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264 | Release Notes | |
| https://security.netapp.com/advisory/ntap-20240621-0006 |
|
| URL | Date | SRC |
|---|---|---|
| https://jsfiddle.net/oz5twjd9 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d | 2024-06-21 | |
| https://github.com/caolan/async/compare/v2.6.3...v2.6.4 | 2024-06-21 | |
| https://github.com/caolan/async/pull/1828 | 2024-06-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Async Project Search vendor "Async Project" | Async Search vendor "Async Project" for product "Async" | < 2.6.4 Search vendor "Async Project" for product "Async" and version " < 2.6.4" | - |
Affected
| ||||||
| Async Project Search vendor "Async Project" | Async Search vendor "Async Project" for product "Async" | >= 3.0.0 < 3.2.2 Search vendor "Async Project" for product "Async" and version " >= 3.0.0 < 3.2.2" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||