Critical severity · published Dec 25, 2022
CVE-2021-4279
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Json-patch · Starcounter-jack
before 3.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4279
Patch
https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9
Exploit
https://github.com/Starcounter-Jack/JSON-Patch/pull/262
Release Notes
https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1
Third Party Advisory
https://vuldb.com/?ctiid.216778
Third Party Advisory
https://vuldb.com/?id.216778
More from Json-patch
7.7
CVE-2018-14632
An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7