Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-dxn8-er51-b7gu

Summary

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143 introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.

Aliases

alias	CVE-2022-21190

alias	GHSA-jjf5-wx3j-3fv7

Fixed_packages

url	pkg:npm/convict@6.2.3
purl	pkg:npm/convict@6.2.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/convict@6.2.3

Affected_packages

References

reference_url	https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808
reference_id
reference_type
scores
url	https://gist.github.com/dellalibera/cebce20e51410acebff1f46afdc89808

reference_url	https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571
reference_id
reference_type
scores
url	https://github.com/mozilla/node-convict/blob/3b86be087d8f14681a9c889d45da7fe3ad9cd880/packages/convict/src/main.js%23L571

reference_url	https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07
reference_id
reference_type
scores
url	https://github.com/mozilla/node-convict/blob/master/CHANGELOG.md%23623---2022-05-07

reference_url	https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75
reference_id
reference_type
scores
url	https://github.com/mozilla/node-convict/commit/1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75

reference_url	https://snyk.io/vuln/SNYK-JS-CONVICT-2774757
reference_id
reference_type
scores
url	https://snyk.io/vuln/SNYK-JS-CONVICT-2774757

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2022-21190
reference_id	CVE-2022-21190
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2022-21190

reference_url	https://github.com/advisories/GHSA-jjf5-wx3j-3fv7
reference_id	GHSA-jjf5-wx3j-3fv7
reference_type
scores
url	https://github.com/advisories/GHSA-jjf5-wx3j-3fv7

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	1321
name	Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dxn8-er51-b7gu

Vulnerability Instance