by Kastro
Paper/Archive/CVE-2021-4307

CVE-2021-4307

Yomguithereal Baobab — Yomguithereal Baobab prototype pollution

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.6.706 × 2014.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The patch is named c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.

Affected

ProductAffectedFixed inSource
Baobab2.0–CNA
Baobab2.1–CNA
Baobab2.2–CNA
Baobab2.3–CNA
Baobab2.4–CNA
Baobab2.5–CNA
Baobab2.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.217627refvuldb.com/?ctiid.217627refgithub.com/Yomguithereal/baobab/pull/511patchgithub.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19patchgithub.com/Yomguithereal/baobab/releases/tag/2.6.1