~ / search / GHSA-jx5q-g37m-h5hj

GHSA-jx5q-g37m-h5hj

Client-Side JavaScript Prototype Pollution in oro/platform

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-43852

Packages

EcosystemPackageAffectedFixed in
Packagist oro/platform >= 4.1.0, < 4.1.14 4.1.14
Packagist oro/platform >= 4.2.0, < 4.2.8 4.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. ### Workarounds Configure WAF to drop requests containing next strings: `__proto__` , `constructor[prototype]`, `constructor.prototype`

References

External links from the advisory. They lead to third-party sites.