CVE-2021-23682
Last modified
CVE-2021-23682 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.. EPSS estimates a 2.08% chance of exploitation in the next 30 days.
Description
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Appwrite | Appwrite | < 0.11.1 |
| Appwrite | Appwrite | >= 0.12.0, < 0.12.2 |
| Litespeed.Js Project | Litespeed.Js | < 0.3.12 |
References
- https://github.com/appwrite/appwrite/pull/2778Patch, Third Party Advisory
- https://github.com/appwrite/appwrite/releases/tag/0.11.1Release Notes, Third Party Advisory
- https://github.com/appwrite/appwrite/releases/tag/0.12.2Release Notes, Third Party Advisory
- https://github.com/litespeed-js/litespeed.js/pull/18Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820Exploit, Third Party Advisory
- https://github.com/appwrite/appwrite/pull/2778Patch, Third Party Advisory
- https://github.com/appwrite/appwrite/releases/tag/0.11.1Release Notes, Third Party Advisory
- https://github.com/appwrite/appwrite/releases/tag/0.12.2Release Notes, Third Party Advisory
- https://github.com/litespeed-js/litespeed.js/pull/18Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250Exploit, Third Party Advisory
- https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-23682?
How severe is CVE-2021-23682?
How do I fix CVE-2021-23682?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-2366Vulnerability in the Primavera P6 Enterprise Project Portfol…6.4
- CVE-2021-23663All versions of package sey are vulnerable to Prototype Poll…9.8
- CVE-2021-23664The package @isomorphic-git/cors-proxy before 2.7.1 are vuln…7.5
- CVE-2021-2367Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
- CVE-2021-23673This affects all versions of package pekeupload. If an attac…6.1
- CVE-2021-2368Vulnerability in the Siebel CRM product of Oracle Siebel CRM…5.9
- CVE-2021-2369Vulnerability in the Java SE, Oracle GraalVM Enterprise Edit…4.3
- CVE-2021-2370Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
- CVE-2021-23700All versions of package merge-deep2 are vulnerable to Protot…9.8
- CVE-2021-23702The package object-extend from 0.0.0 are vulnerable to Proto…9.8
- CVE-2021-2371Vulnerability in the Oracle Coherence product of Oracle Fusi…7.5
- CVE-2021-23718The package ssrf-agent before 1.0.5 are vulnerable to Server…7.5
Are you affected by CVE-2021-23682?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST