CVE-2021-23444

MEDIUM5.6EPSS 1.5%

Prototype Pollution in jointjs

發布日:2021/9/22修改日:2025/1/14
也稱為:GHSA-f3pp-32qc-36w4

描述

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

參考連結(7)